diff --git a/.github/actions/setup-node/action.yml b/.github/actions/setup-node/action.yml
index 48fb3e9..a76ad36 100644
--- a/.github/actions/setup-node/action.yml
+++ b/.github/actions/setup-node/action.yml
@@ -4,12 +4,12 @@ runs:
   using: "composite"
   steps:
     - name: Install pnpm
-      uses: pnpm/action-setup@v4.0.0
+      uses: pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2 # v4.0.0
       with:
         version: 10.8.1
 
     - name: Setup Node.js 20.12.0
-      uses: actions/setup-node@v4.0.0
+      uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0
       with:
         node-version: 20.12.0
         cache: pnpm
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 461129f..d623632 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,7 +19,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Setup Node & pnpm
         uses: ./.github/actions/setup-node
diff --git a/.github/workflows/pinact.yml b/.github/workflows/pinact.yml
index ad5fcdc..a52832a 100644
--- a/.github/workflows/pinact.yml
+++ b/.github/workflows/pinact.yml
@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/update-dependencies.yml b/.github/workflows/update-dependencies.yml
index 3f0c38a..b0952db 100644
--- a/.github/workflows/update-dependencies.yml
+++ b/.github/workflows/update-dependencies.yml
@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Setup Node & pnpm
         uses: ./.github/actions/setup-node
@@ -30,7 +30,7 @@ jobs:
         run: pnpm up --latest --no-frozen-lockfile
 
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v7.0.0
+        uses: peter-evans/create-pull-request@4320041ed380b20e97d388d56a7fb4f9b8c20e79 # v7.0.0
         with:
           commit-message: 'chore(deps): update all dependencies'
           title: 'chore(deps): update all dependencies'
diff --git a/.github/workflows/vrt.yml b/.github/workflows/vrt.yml
index 69e29a3..3a41efc 100644
--- a/.github/workflows/vrt.yml
+++ b/.github/workflows/vrt.yml
@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           fetch-depth: 0
           persist-credentials: false