diff --git a/.github/workflows/prompty-python.yml b/.github/workflows/prompty-python.yml
index 64360bef..f19647f1 100644
--- a/.github/workflows/prompty-python.yml
+++ b/.github/workflows/prompty-python.yml
@@ -85,6 +85,6 @@ jobs:
           flit build --format sdist
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
           packages-dir: ./runtime/python/prompty/dist
diff --git a/.github/workflows/prompty-rust-check.yml b/.github/workflows/prompty-rust-check.yml
index 82d4714b..0bedb744 100644
--- a/.github/workflows/prompty-rust-check.yml
+++ b/.github/workflows/prompty-rust-check.yml
@@ -25,7 +25,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@master
+        uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1
         with:
           toolchain: ${{ matrix.toolchain }}
           components: rustfmt, clippy
diff --git a/.github/workflows/prompty-rust.yml b/.github/workflows/prompty-rust.yml
index 9773cc7e..25f78c8e 100644
--- a/.github/workflows/prompty-rust.yml
+++ b/.github/workflows/prompty-rust.yml
@@ -43,7 +43,7 @@ jobs:
           ref: ${{ github.event.pull_request.merge_commit_sha || github.ref }}
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1
 
       - name: Resolve release version
         run: |
diff --git a/.github/workflows/schema-repro-check.yml b/.github/workflows/schema-repro-check.yml
index bb18a8c0..41946646 100644
--- a/.github/workflows/schema-repro-check.yml
+++ b/.github/workflows/schema-repro-check.yml
@@ -130,7 +130,7 @@ jobs:
       #   dotnet    csharp/driver.js runs `dotnet format <csproj>`
       #   gofmt     go/driver.js runs `gofmt -w` (and `goimports -w` if present)
       - name: Install Rust toolchain (provides rustfmt)
-        uses: dtolnay/rust-toolchain@master
+        uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # v1
         with:
           toolchain: '1.97.1'
           components: rustfmt