diff --git a/.github/workflows/gh-pages.yml b/.github/workflows/gh-pages.yml
index 6b52e798..888b7ceb 100644
--- a/.github/workflows/gh-pages.yml
+++ b/.github/workflows/gh-pages.yml
@@ -9,12 +9,12 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # needed for depext to work
       - run: sudo apt-get update && sudo apt-get install mccs
 
-      - uses: ocaml/setup-ocaml@v3
+      - uses: ocaml/setup-ocaml@15d660006c1d3110d77c34b7faa3bddefe8b82f0 # v3.7.0
         with:
           ocaml-compiler: '5.1.x'
           dune-cache: true
@@ -27,7 +27,7 @@ jobs:
         run: opam exec -- odig odoc --cache-dir=_doc/ opentelemetry opentelemetry-lwt opentelemetry-client-ocurl opentelemetry-cohttp-lwt
 
       - name: Deploy
-        uses: peaceiris/actions-gh-pages@v3
+        uses: peaceiris/actions-gh-pages@373f7f263a76c20808c831209c920827a82a2847 # v3.9.3
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./_doc/html
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 005aad45..f28244c3 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           submodules: recursive
 
@@ -34,7 +34,7 @@ jobs:
         if: ${{ matrix.os == 'ubuntu-latest' }}
 
       - name: Use OCaml ${{ matrix.ocaml-compiler }}
-        uses: ocaml/setup-ocaml@v3
+        uses: ocaml/setup-ocaml@15d660006c1d3110d77c34b7faa3bddefe8b82f0 # v3.7.0
         with:
           ocaml-compiler: ${{ matrix.ocaml-compiler }}
           opam-depext-flags: --with-test
diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml
index c80e71f7..68c39d71 100644
--- a/.github/workflows/nix.yml
+++ b/.github/workflows/nix.yml
@@ -7,8 +7,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout tree
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           submodules: true
-      - uses: cachix/install-nix-action@v30
+      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
       - run: nix develop -L .# -c dune build @runtest @check
diff --git a/src/client-cohttp-eio/opentelemetry_client_cohttp_eio.ml b/src/client-cohttp-eio/opentelemetry_client_cohttp_eio.ml
index 189b341e..6ec184ed 100644
--- a/src/client-cohttp-eio/opentelemetry_client_cohttp_eio.ml
+++ b/src/client-cohttp-eio/opentelemetry_client_cohttp_eio.ml
@@ -222,6 +222,7 @@ end
    exceptions inside should be caught, see
    https://opentelemetry.io/docs/reference/specification/error-handling/ *)
 let mk_emitter ~stop ~net (config : Config.t) : (module EMITTER) =
+  let signal_stop () = Atomic.set stop true in
   (* local helpers *)
   let open struct
     let client =
@@ -235,13 +236,14 @@ let mk_emitter ~stop ~net (config : Config.t) : (module EMITTER) =
       | Ok () -> ()
       | Error `Sysbreak ->
         Printf.eprintf "ctrl-c captured, stopping\n%!";
-        Atomic.set stop true
+        signal_stop ()
       | Error err ->
         (* TODO: log error _via_ otel? *)
         Atomic.incr n_errors;
-        report_err_ err;
-        (* avoid crazy error loop *)
-        Eio_unix.sleep 3.
+        (* No backoff: cleanup's forced flush must not stall process exit.
+           Skip the report once shutdown is signalled -- a failed export there
+           is expected teardown noise, not a real error. *)
+        if not (Atomic.get stop) then report_err_ err
 
     let timeout =
       if config.batch_timeout_ms > 0 then
@@ -336,7 +338,7 @@ let mk_emitter ~stop ~net (config : Config.t) : (module EMITTER) =
     let cleanup ~on_done () =
       if Config.Env.get_debug () then
         Printf.eprintf "opentelemetry: exiting…\n%!";
-      Atomic.set stop true;
+      signal_stop ();
       run_tick_callbacks ();
       sample_gc_metrics_if_needed ();
       emit_all ~force:true;
@@ -449,12 +451,17 @@ let create_backend ~sw ?(stop = Atomic.make false) ?(config = Config.make ())
 
      NOTE: This cannot be located inside the [Backend], because switches
      are not thread safe, and cannot be used accross domains, but the
-     backend is accessed across domains. *)
-  Eio.Fiber.fork ~sw (fun () ->
-      while not @@ Atomic.get stop do
+     backend is accessed across domains.
+
+     Daemon so the switch cancels the inter-tick sleep at teardown rather than
+     waiting it out; [cleanup] force-flushes the final batch before the switch
+     returns, so the cancel can at worst drop a tick already mid-send. *)
+  Eio.Fiber.fork_daemon ~sw (fun () ->
+      while not (Atomic.get stop) do
         Eio.Time.sleep env#clock 0.5;
-        B.tick ()
-      done);
+        if not (Atomic.get stop) then B.tick ()
+      done;
+      `Stop_daemon);
 
   (module B)