diff --git a/.github/generate-test-steps.js b/.github/generate-test-steps.js
index 1393c81c..6d53c697 100644
--- a/.github/generate-test-steps.js
+++ b/.github/generate-test-steps.js
@@ -1,6 +1,6 @@
 const { readdirSync, readFileSync, existsSync, statSync } = require('node:fs');
 
-const stepsByLanguage = {
+const defaultSteps = {
     javascript: {
         preTest: ["npm install"],
         test: ["npm test"],
@@ -33,7 +33,7 @@ for (const language of readdirSync('.')) {
 
         const config = JSON.parse(readFileSync(directory + '/.tbd-example.json', 'utf8'));
 
-        var preTestCommands = stepsByLanguage[language].preTest
+        var preTestCommands = defaultSteps[language].preTest
         if (config.tests && config.tests.pre) {
             preTestCommands = config.tests.pre;
         }
@@ -41,7 +41,7 @@ for (const language of readdirSync('.')) {
             preTestCommands = formatCommands(preTestCommands);
         }
 
-        var testCommands = stepsByLanguage[language].test
+        var testCommands = defaultSteps[language].test
         if (config.tests && config.tests.command) {
             testCommands = [config.tests.command];
         } else if (config.tests && config.tests.commands) {
@@ -52,7 +52,8 @@ for (const language of readdirSync('.')) {
         }
 
         examples.push({
-            name: example,
+            name: config.name || example,
+            directory: directory,
             preTestCommands: preTestCommands,
             testCommands: testCommands
         });
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index fe8ebea9..ac736c47 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -1,7 +1,8 @@
 name: Tests
-
 on: [push]
 
+permissions: read-all
+
 jobs:
   all:
     name: Find all examples
@@ -9,7 +10,7 @@ jobs:
     outputs:
       languages: ${{ steps.build-matrix.outputs.languages }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - name: discover all examples
         id: build-matrix
         run: node .github/generate-test-steps.js >> "$GITHUB_OUTPUT"
@@ -23,17 +24,17 @@ jobs:
       matrix:
         example: ${{ fromJSON(needs.all.outputs.languages).javascript }}
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
         with:
           node-version: '20.4.0'
       - name: test setup
         run: ${{ matrix.example.preTestCommands }}
-        working-directory: javascript/${{ matrix.example.name }}
+        working-directory: ${{ matrix.example.directory }}
         if: matrix.example.preTestCommands != null
       - name: test
         run: ${{ matrix.example.testCommands }}
-        working-directory: javascript/${{ matrix.example.name }}
+        working-directory: ${{ matrix.example.directory }}
 
   kotlin:
     name: Kotlin (${{ matrix.example.name }})
@@ -45,19 +46,19 @@ jobs:
         example: ${{ fromJSON(needs.all.outputs.languages).kotlin }}
     steps:
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - name: Enable KVM
         run: |
           echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
           sudo udevadm control --reload-rules
           sudo udevadm trigger --name-match=kvm
       - name: Set up JDK 17
-        uses: actions/setup-java@v2
+        uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1
         with:
           java-version: '17'
           distribution: 'adopt'
       - name: Cache Gradle packages
-        uses: actions/cache@v2
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
         with:
           path: |
             ~/.gradle/caches
@@ -66,14 +67,14 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-gradle-
       - name: Setup Android SDK
-        uses: android-actions/setup-android@v2
+        uses: android-actions/setup-android@00854ea68c109d98c75d956347303bf7c45b0277 # v3.2.1
       - name: test setup
         run: ${{ matrix.example.preTestCommands }}
-        working-directory: kotlin/${{ matrix.example.name }}
+        working-directory: ${{ matrix.example.directory }}
         if: matrix.example.preTestCommands != null
       - name: test in android emulator
-        uses: reactivecircus/android-emulator-runner@v2
+        uses: reactivecircus/android-emulator-runner@77986be26589807b8ebab3fde7bbf5c60dabec32 # v2.31.0
         with:
           api-level: 29
           script: ${{ matrix.example.testCommands }}
-          working-directory: kotlin/${{ matrix.example.name }}
+          working-directory: ${{ matrix.example.directory }}
diff --git a/javascript/shared-todo/.tbd-example.json b/javascript/shared-todo/.tbd-example.json
index d4c0d04d..3a4fc96d 100644
--- a/javascript/shared-todo/.tbd-example.json
+++ b/javascript/shared-todo/.tbd-example.json
@@ -1,5 +1,5 @@
 {
-  "name": "Shared TODO (completed)",
+  "name": "Shared TODO",
   "tests": {
     "pre": ["npm install", "npx playwright install --with-deps"],
     "command": "npm run test:browser"
diff --git a/javascript/tbdex-pfi-exemplar/Dockerfile b/javascript/tbdex-pfi-exemplar/Dockerfile
index 5eed53c0..62ade731 100644
--- a/javascript/tbdex-pfi-exemplar/Dockerfile
+++ b/javascript/tbdex-pfi-exemplar/Dockerfile
@@ -1,5 +1,5 @@
 # Use the official Node.js image as the base image
-FROM node:lts
+FROM node:lts@sha256:ab71b9da5ba19445dc5bb76bf99c218941db2c4d70ff4de4e0d9ec90920bfe3f
 
 # Set the working directory inside the container
 WORKDIR /home/node/app
@@ -12,6 +12,7 @@ RUN npm i
 
 # Download and install dbmate
 RUN curl -fsSL https://github.com/amacneil/dbmate/releases/download/v1.12.1/dbmate-linux-amd64 -o dbmate \
+    && echo "36430799fa4a4265e05593adf6b5705339c8ddc1d0bcc94040f548c0304c5cf4  dbmate" | sha256sum -c \
     && chmod +x dbmate \
     && mv dbmate /usr/local/bin
 
diff --git a/javascript/todo/.tbd-example.json b/javascript/todo/.tbd-example.json
index 55002678..1adfdb25 100644
--- a/javascript/todo/.tbd-example.json
+++ b/javascript/todo/.tbd-example.json
@@ -1,5 +1,5 @@
 {
-  "name": "TODO (completed)",
+  "name": "TODO",
   "tests": {
     "pre": ["npm install", "npx playwright install --with-deps"],
     "command": "npm run test:browser"