diff --git a/.github/workflows/autoassign.yml b/.github/workflows/autoassign.yml
index 7d2b62e..5fbee43 100755
--- a/.github/workflows/autoassign.yml
+++ b/.github/workflows/autoassign.yml
@@ -9,6 +9,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
         - name: 'Auto-assign issue'
-          uses: pozil/auto-assign-issue@v4.0.1
+          uses: pozil/auto-assign-issue@af6beea6bdf1e8eb373f061c5bc168681fc6d011 # v4.0.1
           with:
             assignees: modem7
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index e5c471d..eb212ae 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -11,7 +11,7 @@ jobs:
       py_version: ${{ steps.python_version.outputs.py_version }}
       cp_tag: ${{ steps.python_version.outputs.cp_tag }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
       - name: Fetch Python version from docker-borgmatic Dockerfile
@@ -53,7 +53,7 @@ jobs:
               recipes_found=false
           fi
           echo "recipes_found=$recipes_found" >> $GITHUB_OUTPUT
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: recipe_list
           path: recipe_list.txt
@@ -68,15 +68,15 @@ jobs:
     env:
       CIBW_BUILD: '${{ needs.setup.outputs.cp_tag }}-musllinux_*'
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
         with:
           platforms: all
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: '${{ needs.setup.outputs.py_version }}'
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: recipe_list
           path: ../workflow_artifacts/
@@ -87,7 +87,7 @@ jobs:
           while read -r folder; do
               python3 wheel_builder.py "$folder";
           done < ../workflow_artifacts/recipe_list.txt
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: wheelhouse
           path: wheelhouse/
@@ -98,7 +98,7 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ github.ref == 'refs/heads/master' && github.event_name == 'push' && github.repository_owner == 'modem7' }}
     steps:
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: wheelhouse
           path: wheelhouse/
@@ -111,7 +111,7 @@ jobs:
             https://api.cloudsmith.io/v1/user/self/ \
             | jq -r '.authenticated'
       - name: Install Cloudsmith CLI
-        uses: cloudsmith-io/cloudsmith-cli-action@v2
+        uses: cloudsmith-io/cloudsmith-cli-action@159f1619275d5d3147f059c3cc110938ec221d16 # v2
         with:
           api-key: ${{ secrets.CLOUDSMITH_API_KEY }}
       - name: Push wheels to Cloudsmith
diff --git a/.github/workflows/sync-recipes.yml b/.github/workflows/sync-recipes.yml
index 697ff15..33b97c9 100644
--- a/.github/workflows/sync-recipes.yml
+++ b/.github/workflows/sync-recipes.yml
@@ -15,7 +15,7 @@ jobs:
       pull-requests: write
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Parse requirements.txt and sync recipes
         id: sync
@@ -63,7 +63,7 @@ jobs:
 
       - name: Create Pull Request
         if: steps.sync.outputs.changed == 'true'
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           branch: auto/sync-recipes