Last friday i went through a bunch of our workflows and started pinning their hashes... it got annoying so i created a little app to assist, it is quite simple, you can add a list of workflow org you are ok with version tags (if you want to keep them up-to-date) , as the app search through the repo and find dubious workflow, it will prompt and let you know what hash it is updating it to and link for you to verify... if you accept, it add to config and automatically replace the ones that matches the same version tag in the future, saving you time. The config can be saved in same repository so you can rerun anytime.