diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1a2142a..d947d0d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,14 +10,14 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Validate manifests parse + declare schema_version
         run: |
           for f in pack.yaml targets/*.intent.yaml _kos/kos.yaml; do
             python3 -c "import yaml; d=yaml.safe_load(open('$f')); assert 'schema_version' in d, 'missing schema_version in $f'; print('ok:', '$f')"
           done
       - name: markdownlint
-        uses: DavidAnson/markdownlint-cli2-action@v16
+        uses: DavidAnson/markdownlint-cli2-action@b4c9feab76d8025d1e83c653fa3990936df0e6c8 # v16.0.0
         with:
           globs: '**/*.md'
         continue-on-error: true