diff --git a/.github/workflows/build-relocatable-packages.yml b/.github/workflows/build-relocatable-packages.yml
index 8a139f0d..825b21f5 100644
--- a/.github/workflows/build-relocatable-packages.yml
+++ b/.github/workflows/build-relocatable-packages.yml
@@ -28,7 +28,6 @@ on:
 
 permissions:
   contents: read
-  id-token: write   # Required for OIDC S3 upload
 
 env:
   ROCM_VERSION: ${{ github.event.inputs.rocm_version || '' }}
@@ -42,9 +41,12 @@ jobs:
   build-ubuntu:
     name: Build (Ubuntu 22.04)
     runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-22.04' }}
+    permissions:
+      contents: read
+      id-token: write   # Required for OIDC S3 upload
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           submodules: recursive
           fetch-depth: 0   # for branch.commit version tags
@@ -76,7 +78,7 @@ jobs:
 
       - name: Upload artifacts
         if: github.ref_name != 'candidate' && github.base_ref != 'candidate'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ubuntu-22.04-packages
           path: |
@@ -86,7 +88,7 @@ jobs:
 
       - name: Configure AWS credentials (OIDC)
         if: github.repository == 'ROCm/TransferBench' && vars.AWS_S3_BUCKET != '' && github.ref_name != 'candidate' && github.base_ref != 'candidate'
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
         with:
           role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
           aws-region: us-east-1
@@ -149,11 +151,15 @@ jobs:
   build-manylinux:
     name: Build (manylinux_2_28)
     runs-on: ${{ vars.RUNNER_LABEL_CONTAINER || 'ubuntu-latest' }}
+    permissions:
+      contents: read
+      id-token: write   # Required for OIDC S3 upload
     container:
-      image: quay.io/pypa/manylinux_2_28_x86_64
+      # Pinned by digest; the floating tag is retained for readability.
+      image: quay.io/pypa/manylinux_2_28_x86_64:latest@sha256:4131ddd7acb9c6c966af02fe7e71edc51e078c2d41f475966697676430bfa2ae
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           submodules: recursive
           fetch-depth: 0
@@ -186,7 +192,7 @@ jobs:
 
       - name: Upload artifacts
         if: github.ref_name != 'candidate' && github.base_ref != 'candidate'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: manylinux_2_28-packages
           path: |
@@ -202,7 +208,7 @@ jobs:
 
       - name: Configure AWS credentials (OIDC)
         if: github.repository == 'ROCm/TransferBench' && vars.AWS_S3_BUCKET != '' && github.ref_name != 'candidate' && github.base_ref != 'candidate'
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
         with:
           role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
           aws-region: us-east-1
@@ -298,7 +304,7 @@ jobs:
 
       - name: Upload report
         if: github.ref_name != 'candidate' && github.base_ref != 'candidate'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: build-report
           path: report/build-report.md
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index fdcd5276..f88d45b8 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -19,7 +19,7 @@ jobs:
   analyze:
     name: Analyze (C/C++)
     runs-on: ubuntu-latest
-    container: rocm/dev-ubuntu-22.04:latest
+    container: rocm/dev-ubuntu-22.04:latest@sha256:6c11663a93966c040cd56dc73ed6d6761cdb887068f3f8940c4d3fe4e6829f10   # 10.1.0-full
     permissions:
       security-events: write
       packages: read
@@ -34,7 +34,7 @@ jobs:
           DEBIAN_FRONTEND=noninteractive apt-get install -y git
 
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Configure Git Safe Directory
         run: |
@@ -46,7 +46,7 @@ jobs:
           apt-get install -y build-essential cmake libnuma-dev
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@9f759ee644a3e7c15c1390abf49868036c00067b # v3.38.3
         with:
           languages: c-cpp
           build-mode: manual
@@ -64,6 +64,6 @@ jobs:
           make -j $(nproc)
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@9f759ee644a3e7c15c1390abf49868036c00067b # v3.38.3
         with:
           category: "/language:c-cpp"
diff --git a/docs/sphinx/requirements.txt b/docs/sphinx/requirements.txt
index 9490a892..47182f65 100644
--- a/docs/sphinx/requirements.txt
+++ b/docs/sphinx/requirements.txt
@@ -1,97 +1,94 @@
 # This file was autogenerated by uv via the following command:
-#    uv pip compile /home/pmoutsia/TransferBench/docs/sphinx/requirements.in --python-version 3.10 --output-file /home/pmoutsia/TransferBench/docs/sphinx/requirements.txt
+#    uv pip compile requirements.in --python-version 3.10 --output-file requirements.txt
 accessible-pygments==0.0.5
     # via pydata-sphinx-theme
-alabaster==0.7.16
+alabaster==1.0.0
     # via sphinx
-asttokens==3.0.0
+asttokens==3.0.2
     # via stack-data
-attrs==25.1.0
+attrs==26.1.0
     # via
     #   jsonschema
     #   jupyter-cache
     #   referencing
-babel==2.15.0
+babel==2.18.0
     # via
     #   pydata-sphinx-theme
     #   sphinx
-beautifulsoup4==4.12.3
+beautifulsoup4==4.15.0
     # via pydata-sphinx-theme
-breathe==4.35.0
+breathe==5.1.0
     # via rocm-docs-core
-certifi==2024.2.2
+certifi==2026.7.22
     # via requests
-cffi==1.16.0
+cffi==2.1.1
     # via
     #   cryptography
     #   pynacl
-charset-normalizer==3.3.2
+charset-normalizer==3.5.2
     # via requests
-click==8.1.7
+click==8.5.0
     # via
     #   jupyter-cache
     #   sphinx-external-toc
-comm==0.2.2
+comm==0.2.3
     # via ipykernel
-cryptography==42.0.7
+cryptography==50.0.2
     # via pyjwt
-debugpy==1.8.12
+debugpy==1.8.22
     # via ipykernel
-decorator==5.1.1
+decorator==5.3.1
     # via ipython
-deprecated==1.2.14
-    # via pygithub
 docutils==0.21.2
     # via
-    #   breathe
     #   myst-parser
     #   pydata-sphinx-theme
     #   sphinx
-exceptiongroup==1.2.2
+exceptiongroup==1.3.1
     # via ipython
-executing==2.2.0
+executing==2.3.0
     # via stack-data
-fastjsonschema==2.19.1
+fastjsonschema==2.22.2
     # via
     #   nbformat
     #   rocm-docs-core
-gitdb==4.0.11
+gitdb==4.0.12
     # via gitpython
-gitpython==3.1.43
+gitpython==3.2.1
     # via rocm-docs-core
-greenlet==3.1.1
+greenlet==3.5.6
     # via sqlalchemy
-idna==3.7
+idna==3.20
     # via requests
-imagesize==1.4.1
+imagesize==2.0.1
     # via sphinx
-importlib-metadata==8.6.1
+importlib-metadata==9.0.1
     # via
     #   jupyter-cache
     #   myst-nb
-ipykernel==6.29.5
+ipykernel==7.3.0
     # via myst-nb
-ipython==8.31.0
+ipython==8.39.0
     # via
     #   ipykernel
     #   myst-nb
-jedi==0.19.2
+jedi==0.20.1
     # via ipython
-jinja2==3.1.4
+jinja2==3.1.6
     # via
     #   myst-parser
     #   sphinx
-jsonschema==4.23.0
+jsonschema==4.26.0
     # via nbformat
-jsonschema-specifications==2024.10.1
+jsonschema-specifications==2025.9.1
     # via jsonschema
 jupyter-cache==1.0.1
     # via myst-nb
-jupyter-client==8.6.3
+jupyter-client==8.10.0
     # via
     #   ipykernel
     #   nbclient
-jupyter-core==5.7.2
+jupyter-core==5.9.1
     # via
     #   ipykernel
     #   jupyter-client
@@ -101,104 +98,105 @@ markdown-it-py==3.0.0
     # via
     #   mdit-py-plugins
     #   myst-parser
-markupsafe==2.1.5
+markupsafe==3.0.4
     # via jinja2
-matplotlib-inline==0.1.7
+matplotlib-inline==0.2.2
     # via
     #   ipykernel
     #   ipython
-mdit-py-plugins==0.4.1
+mdit-py-plugins==0.6.1
     # via myst-parser
 mdurl==0.1.2
     # via markdown-it-py
-myst-nb==1.1.2
+myst-nb==1.4.0
     # via rocm-docs-core
-myst-parser==3.0.1
+myst-parser==4.0.1
     # via myst-nb
-nbclient==0.10.2
+nbclient==0.11.0
     # via
     #   jupyter-cache
     #   myst-nb
-nbformat==5.10.4
+nbformat==5.11.1
     # via
     #   jupyter-cache
     #   myst-nb
     #   nbclient
-nest-asyncio==1.6.0
+nest-asyncio2==1.7.4
     # via ipykernel
-packaging==24.0
+packaging==26.3
     # via
     #   ipykernel
     #   pydata-sphinx-theme
     #   sphinx
-parso==0.8.4
+parso==0.8.7
     # via jedi
 pexpect==4.9.0
     # via ipython
-platformdirs==4.3.6
+platformdirs==4.12.4
     # via jupyter-core
-prompt-toolkit==3.0.50
+prompt-toolkit==3.0.53
     # via ipython
-psutil==6.1.1
+psutil==7.2.2
     # via ipykernel
 ptyprocess==0.7.0
     # via pexpect
-pure-eval==0.2.3
+pure-eval==0.2.4
     # via stack-data
-pycparser==2.22
+pycparser==3.11
     # via cffi
 pydata-sphinx-theme==0.15.4
     # via
     #   rocm-docs-core
     #   sphinx-book-theme
-pygithub==2.3.0
+pygithub==2.10.0
     # via rocm-docs-core
-pygments==2.18.0
+pygments==2.21.0
     # via
     #   accessible-pygments
     #   ipython
     #   pydata-sphinx-theme
     #   sphinx
-pyjwt==2.8.0
+pyjwt==2.15.1
     # via pygithub
-pynacl==1.5.0
+pynacl==1.6.2
     # via pygithub
 python-dateutil==2.9.0.post0
     # via jupyter-client
-pyyaml==6.0.1
+pyyaml==6.0.3
     # via
     #   jupyter-cache
     #   myst-nb
     #   myst-parser
     #   rocm-docs-core
     #   sphinx-external-toc
-pyzmq==26.2.1
+pyzmq==27.2.0
     # via
     #   ipykernel
     #   jupyter-client
-referencing==0.36.2
+referencing==0.37.0
     # via
     #   jsonschema
     #   jsonschema-specifications
-requests==2.32.2
+requests==2.34.2
     # via
     #   pygithub
+    #   rocm-docs-core
     #   sphinx
-rocm-docs-core @ git+https://github.com/ROCm/rocm-docs-core.git@develop
-    # via -r TransferBench/docs/sphinx/requirements.in
-rpds-py==0.22.3
+rocm-docs-core @ git+https://github.com/ROCm/rocm-docs-core.git@268254f585eb40b6f53a9d97318a4890a4b3d7f3
+    # via -r requirements.in
+rpds-py==0.30.0
     # via
     #   jsonschema
     #   referencing
 six==1.17.0
     # via python-dateutil
-smmap==5.0.1
+smmap==5.0.3
     # via gitdb
-snowballstemmer==2.2.0
+snowballstemmer==3.1.1
     # via sphinx
-soupsieve==2.5
+soupsieve==2.10
     # via beautifulsoup4
-sphinx==7.3.7
+sphinx==8.1.3
     # via
     #   breathe
     #   myst-nb
@@ -209,44 +207,46 @@ sphinx==7.3.7
     #   sphinx-copybutton
     #   sphinx-design
     #   sphinx-external-toc
+    #   sphinx-multitoc-numbering
     #   sphinx-notfound-page
 sphinx-book-theme==1.1.4
     # via rocm-docs-core
 sphinx-copybutton==0.5.2
     # via rocm-docs-core
-sphinx-design==0.6.0
+sphinx-design==0.6.1
     # via rocm-docs-core
-sphinx-external-toc==1.0.1
+sphinx-external-toc==1.1.0
     # via rocm-docs-core
-sphinx-notfound-page==1.0.2
+sphinx-multitoc-numbering==0.1.3
+    # via sphinx-external-toc
+sphinx-notfound-page==1.1.0
     # via rocm-docs-core
-sphinxcontrib-applehelp==1.0.8
+sphinxcontrib-applehelp==2.0.0
     # via sphinx
-sphinxcontrib-devhelp==1.0.6
+sphinxcontrib-devhelp==2.0.0
     # via sphinx
-sphinxcontrib-htmlhelp==2.0.5
+sphinxcontrib-htmlhelp==2.1.0
     # via sphinx
 sphinxcontrib-jsmath==1.0.1
     # via sphinx
-sphinxcontrib-qthelp==1.0.7
+sphinxcontrib-qthelp==2.0.0
     # via sphinx
-sphinxcontrib-serializinghtml==1.1.10
+sphinxcontrib-serializinghtml==2.0.0
     # via sphinx
-sqlalchemy==2.0.37
+sqlalchemy==2.0.54
     # via jupyter-cache
 stack-data==0.6.3
     # via ipython
-tabulate==0.9.0
+tabulate==0.10.0
     # via jupyter-cache
-tomli==2.0.1
+tomli==2.5.0
     # via sphinx
-tornado==6.5
+tornado==6.5.10
     # via
     #   ipykernel
     #   jupyter-client
-traitlets==5.14.3
+traitlets==5.16.1
     # via
-    #   comm
     #   ipykernel
     #   ipython
     #   jupyter-client
@@ -254,21 +254,24 @@ traitlets==5.14.3
     #   matplotlib-inline
     #   nbclient
     #   nbformat
-typing-extensions==4.11.0
+typing-extensions==4.16.0
     # via
+    #   beautifulsoup4
+    #   cryptography
+    #   exceptiongroup
     #   ipython
+    #   jupyter-client
     #   myst-nb
     #   pydata-sphinx-theme
     #   pygithub
+    #   pyjwt
     #   referencing
     #   sqlalchemy
-urllib3==2.6.0
+urllib3==2.8.0
     # via
     #   pygithub
     #   requests
-wcwidth==0.2.13
+wcwidth==0.9.2
     # via prompt-toolkit
-wrapt==1.16.0
-    # via deprecated
-zipp==3.21.0
+zipp==4.1.1
     # via importlib-metadata