diff --git a/.github/actions/install-external-tools/action.yml b/.github/actions/install-external-tools/action.yml
index 5dfeaf61fc..0a44c40eb8 100644
--- a/.github/actions/install-external-tools/action.yml
+++ b/.github/actions/install-external-tools/action.yml
@@ -23,15 +23,17 @@ runs:
     - uses: ./.github/actions/set-up-staticcheck
       # We assume that the Go toolchain will be managed by the caller workflow so we don't set one
       # up here.
-    - run: ./.github/scripts/retry-command.sh go install google.golang.org/protobuf/cmd/protoc-gen-go@latest
+      # All tool versions should match the versions in tools/tool.sh
+      # Protobuf tool versions should match what's in Vault's go.mod
+    - run: ./.github/scripts/retry-command.sh go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.36.5
       shell: bash
-    - run: ./.github/scripts/retry-command.sh go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest
+    - run: ./.github/scripts/retry-command.sh go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.5.1
       shell: bash
-    - run: ./.github/scripts/retry-command.sh go install github.com/favadi/protoc-go-inject-tag@latest
+    - run: ./.github/scripts/retry-command.sh go install github.com/favadi/protoc-go-inject-tag@v1.4.0
       shell: bash
-    - run: ./.github/scripts/retry-command.sh go install golang.org/x/tools/cmd/goimports@latest
+    - run: ./.github/scripts/retry-command.sh go install golang.org/x/tools/cmd/goimports@v0.30.0
       shell: bash
-    - run: ./.github/scripts/retry-command.sh go install github.com/golangci/revgrep/cmd/revgrep@latest
+    - run: ./.github/scripts/retry-command.sh go install github.com/golangci/revgrep/cmd/revgrep@v0.8.0
       shell: bash
-    - run: ./.github/scripts/retry-command.sh go install github.com/loggerhead/enumer@latest
+    - run: ./.github/scripts/retry-command.sh go install github.com/loggerhead/enumer@v0.0.0-20240225233120-0aebd7ae8325
       shell: bash
diff --git a/.github/actions/set-up-buf/action.yml b/.github/actions/set-up-buf/action.yml
index 229f5704b6..133d3b2bf1 100644
--- a/.github/actions/set-up-buf/action.yml
+++ b/.github/actions/set-up-buf/action.yml
@@ -13,7 +13,7 @@ inputs:
   version:
     description: "The version to install (default: latest)"
     type: string
-    default: Latest
+    default: "v1.45.0"
 
 outputs:
   destination:
diff --git a/.github/actions/set-up-gofumpt/action.yml b/.github/actions/set-up-gofumpt/action.yml
index 1e307f7633..5b5dd9bcb3 100644
--- a/.github/actions/set-up-gofumpt/action.yml
+++ b/.github/actions/set-up-gofumpt/action.yml
@@ -13,7 +13,7 @@ inputs:
   version:
     description: "The version to install (default: latest)"
     type: string
-    default: Latest
+    default: "v0.7.0"
 
 outputs:
   destination:
diff --git a/.github/actions/set-up-gosimports/action.yml b/.github/actions/set-up-gosimports/action.yml
index 7563c2e3b3..15608e7e62 100644
--- a/.github/actions/set-up-gosimports/action.yml
+++ b/.github/actions/set-up-gosimports/action.yml
@@ -13,7 +13,7 @@ inputs:
   version:
     description: "The version to install (default: latest)"
     type: string
-    default: Latest
+    default: "v0.3.8"
 
 outputs:
   destination:
diff --git a/.github/actions/set-up-gotestsum/action.yml b/.github/actions/set-up-gotestsum/action.yml
index 97ceb91742..391368a46a 100644
--- a/.github/actions/set-up-gotestsum/action.yml
+++ b/.github/actions/set-up-gotestsum/action.yml
@@ -13,7 +13,7 @@ inputs:
   version:
     description: "The version to install (default: latest)"
     type: string
-    default: Latest
+    default: "v1.12.0"
 
 outputs:
   destination:
diff --git a/.github/actions/set-up-misspell/action.yml b/.github/actions/set-up-misspell/action.yml
index f57ab97f31..fecd8bf4ef 100644
--- a/.github/actions/set-up-misspell/action.yml
+++ b/.github/actions/set-up-misspell/action.yml
@@ -13,7 +13,7 @@ inputs:
   version:
     description: "The version to install (default: latest)"
     type: string
-    default: Latest
+    default: "v0.6.0"
 
 outputs:
   destination:
diff --git a/.github/actions/set-up-shfmt/action.yml b/.github/actions/set-up-shfmt/action.yml
index c550a3e27e..a77449a861 100644
--- a/.github/actions/set-up-shfmt/action.yml
+++ b/.github/actions/set-up-shfmt/action.yml
@@ -13,7 +13,7 @@ inputs:
   version:
     description: "The version to install (default: latest)"
     type: string
-    default: Latest
+    default: "v3.10.0"
 
 outputs:
   destination:
diff --git a/.github/actions/set-up-sqlc/action.yml b/.github/actions/set-up-sqlc/action.yml
index 8986b3f5e4..3d0e25225f 100644
--- a/.github/actions/set-up-sqlc/action.yml
+++ b/.github/actions/set-up-sqlc/action.yml
@@ -13,7 +13,7 @@ inputs:
   version:
     description: "The version to install (default: latest)"
     type: string
-    default: Latest
+    default: "v1.28.0"
 
 outputs:
   destination:
diff --git a/.github/actions/set-up-staticcheck/action.yml b/.github/actions/set-up-staticcheck/action.yml
index 3ec7ac2ae6..3b8d7e0c0c 100644
--- a/.github/actions/set-up-staticcheck/action.yml
+++ b/.github/actions/set-up-staticcheck/action.yml
@@ -13,7 +13,7 @@ inputs:
   version:
     description: "The version to install (default: latest)"
     type: string
-    default: Latest
+    default: "v0.6.0"
 
 outputs:
   destination:
diff --git a/sdk/go.mod b/sdk/go.mod
index 2596c2c8e0..f4d8c2417f 100644
--- a/sdk/go.mod
+++ b/sdk/go.mod
@@ -53,7 +53,7 @@ require (
 	golang.org/x/net v0.34.0
 	golang.org/x/text v0.21.0
 	google.golang.org/grpc v1.69.4
-	google.golang.org/protobuf v1.36.3
+	google.golang.org/protobuf v1.36.5
 )
 
 require (
diff --git a/sdk/go.sum b/sdk/go.sum
index 3d0a230cb4..92c41ad619 100644
--- a/sdk/go.sum
+++ b/sdk/go.sum
@@ -661,8 +661,8 @@ google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2
 google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
-google.golang.org/protobuf v1.36.3 h1:82DV7MYdb8anAVi3qge1wSnMDrnKK7ebr+I0hHRN1BU=
-google.golang.org/protobuf v1.36.3/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
+google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
diff --git a/tools/tools.sh b/tools/tools.sh
index b4f05dc1ec..49dd73394c 100755
--- a/tools/tools.sh
+++ b/tools/tools.sh
@@ -36,20 +36,22 @@ install_external() {
   # If you update this please update check_external below as well as our external tools
   # install action .github/actions/install-external-tools/action.yml
   #
+  # All tool versions should match the versions in .github/actions/install-external-tools/action.yml
+  # Protobuf tool versions should match what's in Vault's go.mod.
   tools=(
-    honnef.co/go/tools/cmd/staticcheck@latest
+    honnef.co/go/tools/cmd/staticcheck@v0.6.0
     github.com/bufbuild/buf/cmd/buf@v1.45.0
-    github.com/favadi/protoc-go-inject-tag@latest
-    github.com/golangci/misspell/cmd/misspell@latest
-    github.com/golangci/revgrep/cmd/revgrep@latest
-    github.com/loggerhead/enumer@latest
-    github.com/rinchsan/gosimports/cmd/gosimports@latest
-    golang.org/x/tools/cmd/goimports@latest
-    google.golang.org/protobuf/cmd/protoc-gen-go@latest
-    google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest
-    gotest.tools/gotestsum@latest
-    mvdan.cc/gofumpt@latest
-    mvdan.cc/sh/v3/cmd/shfmt@latest
+    github.com/favadi/protoc-go-inject-tag@v1.4.0
+    github.com/golangci/misspell/cmd/misspell@v0.6.0
+    github.com/golangci/revgrep/cmd/revgrep@v0.8.0
+    github.com/loggerhead/enumer@v0.0.0-20240225233120-0aebd7ae8325
+    github.com/rinchsan/gosimports/cmd/gosimports@v0.3.8
+    golang.org/x/tools/cmd/goimports@v0.30.0
+    google.golang.org/protobuf/cmd/protoc-gen-go@v1.36.5
+    google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.5.1
+    gotest.tools/gotestsum@v1.12.0
+    mvdan.cc/gofumpt@v0.7.0
+    mvdan.cc/sh/v3/cmd/shfmt@v3.10.0
   )
 
   echo "==> Installing external tools..."