GitHub Actions now supports workflow lockfiles, allowing users to securely manage dependencies by pinning to specific versions instead of mutable tags, which are vulnerable to supply-chain attacks. To utilize this feature, users can install the `gh-actions-lock` extension and run it in their repository to generate a lockfile, which should be committed along with modified workflows. Popular tools like Renovate and Dependabot already support lockfiles, and GitHub recommends verifying them in CI to ensure they are up-to-date and not corrupt, providing a `verify-lockfile.yml` template for this purpose. By using lockfiles, users can enhance the security and integrity of their GitHub Actions workflows.