diff --git a/.github/workflows/linkchecker.yml b/.github/workflows/linkchecker.yml
index 2fff699..ba91335 100644
--- a/.github/workflows/linkchecker.yml
+++ b/.github/workflows/linkchecker.yml
@@ -6,7 +6,7 @@ jobs:
   markdown-link-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@master
-      - uses: gaurav-nelson/github-action-markdown-link-check@0.6.0
+      - uses: actions/checkout@61b9e3751b92087fd0b06925ba6dd6314e06f089 # master
+      - uses: gaurav-nelson/github-action-markdown-link-check@6aac1af405e27b08109e51b72306fc8c852971cd # 0.6.0
         with:
           folder-path: "docs"
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index de31269..736b3c2 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -4,9 +4,9 @@ jobs:
   golangci-lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@61b9e3751b92087fd0b06925ba6dd6314e06f089 # master
       - name: golangci-lint
-        uses: reviewdog/action-golangci-lint@v1
+        uses: reviewdog/action-golangci-lint@02bcf8c1a9febe8620f1ca523b18dd64f82296db # v1
         with:
           github_token: ${{ secrets.github_token }}
           reporter: github-pr-review
diff --git a/.github/workflows/release-sims.yml b/.github/workflows/release-sims.yml
index 08650bf..a37fa23 100644
--- a/.github/workflows/release-sims.yml
+++ b/.github/workflows/release-sims.yml
@@ -8,7 +8,7 @@ jobs:
   cleanup-runs:
     runs-on: ubuntu-latest
     steps:
-      - uses: rokroskar/workflow-run-cleanup-action@master
+      - uses: rokroskar/workflow-run-cleanup-action@c631227427d0452af4994af0940d7655ebc50c7c # master
         env:
           GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
     if: "!startsWith(github.ref, 'refs/tags/') && github.ref != 'refs/heads/master'"
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     if: "!contains(github.event.head_commit.message, 'skip-sims')"
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2
       - run: |
           make build
 
@@ -28,7 +28,7 @@ jobs:
       - name: install runsim
         run: |
           export GO111MODULE="on" && go get github.com/cosmos/tools/cmd/runsim@v1.0.0
-      - uses: actions/cache@v1
+      - uses: actions/cache@f5ce41475b483ad7581884324a6eca9f48f8dcc7 # v1
         with:
           path: ~/go/bin
           key: ${{ runner.os }}-go-runsim-binary
@@ -37,8 +37,8 @@ jobs:
     runs-on: ubuntu-latest
     needs: [build, install-runsim]
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/cache@v1
+      - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2
+      - uses: actions/cache@f5ce41475b483ad7581884324a6eca9f48f8dcc7 # v1
         with:
           path: ~/go/bin
           key: ${{ runner.os }}-go-runsim-binary
diff --git a/.github/workflows/security.yaml b/.github/workflows/security.yaml
index 4593027..a11485c 100644
--- a/.github/workflows/security.yaml
+++ b/.github/workflows/security.yaml
@@ -7,8 +7,8 @@ on:
 
 jobs:
   sast:
-    uses: p2p-org/security-workflows/.github/workflows/sast.yaml@main
+    uses: p2p-org/security-workflows/.github/workflows/sast.yaml@78e85c7981c415d34142f9c278087bb7e15b0c82 # main
     secrets: inherit
   sca:
-    uses: p2p-org/security-workflows/.github/workflows/sca.yaml@main
+    uses: p2p-org/security-workflows/.github/workflows/sca.yaml@78e85c7981c415d34142f9c278087bb7e15b0c82 # main
     secrets: inherit
diff --git a/.github/workflows/sims.yml b/.github/workflows/sims.yml
index 50f03b3..0c073aa 100644
--- a/.github/workflows/sims.yml
+++ b/.github/workflows/sims.yml
@@ -4,7 +4,7 @@ jobs:
   cleanup-runs:
     runs-on: ubuntu-latest
     steps:
-      - uses: rokroskar/workflow-run-cleanup-action@master
+      - uses: rokroskar/workflow-run-cleanup-action@c631227427d0452af4994af0940d7655ebc50c7c # master
         env:
           GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
     if: "!startsWith(github.ref, 'refs/tags/') && github.ref != 'refs/heads/master'"
@@ -20,7 +20,7 @@ jobs:
       - name: install runsim
         run: |
           go get github.com/cosmos/tools/cmd/runsim@v1.0.0
-      - uses: actions/cache@v1
+      - uses: actions/cache@f5ce41475b483ad7581884324a6eca9f48f8dcc7 # v1
         with:
           path: ~/go/bin
           key: ${{ runner.os }}-go-runsim-binary
@@ -32,8 +32,8 @@ jobs:
       - name: Setup env for GO
         run: echo "::add-path::$(go env GOPATH)/bin"
         shell: bash
-      - uses: actions/checkout@v2
-      - uses: technote-space/get-diff-action@v1
+      - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2
+      - uses: technote-space/get-diff-action@98fd8d380c6026fd0564d5a6f98fa2cf5c100c95 # v1
         with:
           SUFFIX_FILTER: |
             .go
@@ -41,7 +41,7 @@ jobs:
             .sum
           SET_ENV_NAME_INSERTIONS: 1
           SET_ENV_NAME_LINES: 1
-      - uses: actions/cache@v1
+      - uses: actions/cache@f5ce41475b483ad7581884324a6eca9f48f8dcc7 # v1
         with:
           path: ~/go/bin
           key: ${{ runner.os }}-go-runsim-binary
@@ -55,7 +55,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: Build
     steps:
-      - uses: technote-space/get-diff-action@v1
+      - uses: technote-space/get-diff-action@98fd8d380c6026fd0564d5a6f98fa2cf5c100c95 # v1
         with:
           SUFFIX_FILTER: |
             .go
@@ -66,8 +66,8 @@ jobs:
       - name: Setup env for GO
         run: echo "::add-path::$(go env GOPATH)/bin"
         shell: bash
-      - uses: actions/checkout@v2
-      - uses: actions/cache@v1
+      - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2
+      - uses: actions/cache@f5ce41475b483ad7581884324a6eca9f48f8dcc7 # v1
         with:
           path: ~/go/bin
           key: ${{ runner.os }}-go-runsim-binary
@@ -85,8 +85,8 @@ jobs:
         run: |
           echo "::add-path::$(go env GOPATH)/bin"
         shell: bash
-      - uses: actions/checkout@v2
-      - uses: technote-space/get-diff-action@v1
+      - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2
+      - uses: technote-space/get-diff-action@98fd8d380c6026fd0564d5a6f98fa2cf5c100c95 # v1
         with:
           SUFFIX_FILTER: |
             .go
@@ -94,7 +94,7 @@ jobs:
             .sum
           SET_ENV_NAME_INSERTIONS: 1
           SET_ENV_NAME_LINES: 1
-      - uses: actions/cache@v1
+      - uses: actions/cache@f5ce41475b483ad7581884324a6eca9f48f8dcc7 # v1
         with:
           path: ~/go/bin
           key: ${{ runner.os }}-go-runsim-binary
@@ -111,8 +111,8 @@ jobs:
       - name: Setup env for GO
         run: echo "::add-path::$(go env GOPATH)/bin"
         shell: bash
-      - uses: actions/checkout@v2
-      - uses: technote-space/get-diff-action@v1
+      - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2
+      - uses: technote-space/get-diff-action@98fd8d380c6026fd0564d5a6f98fa2cf5c100c95 # v1
         with:
           SUFFIX_FILTER: |
             .go
@@ -120,7 +120,7 @@ jobs:
             .sum
           SET_ENV_NAME_INSERTIONS: 1
           SET_ENV_NAME_LINES: 1
-      - uses: actions/cache@v1
+      - uses: actions/cache@f5ce41475b483ad7581884324a6eca9f48f8dcc7 # v1
         with:
           path: ~/go/bin
           key: ${{ runner.os }}-go-runsim-binary
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 079a392..49cfdbd 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -4,7 +4,7 @@ jobs:
   cleanup-runs:
     runs-on: ubuntu-latest
     steps:
-      - uses: rokroskar/workflow-run-cleanup-action@master
+      - uses: rokroskar/workflow-run-cleanup-action@c631227427d0452af4994af0940d7655ebc50c7c # master
         env:
           GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
     if: "!startsWith(github.ref, 'refs/tags/') && github.ref != 'refs/heads/master'"
@@ -12,8 +12,8 @@ jobs:
   test-coverage-upload:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: technote-space/get-diff-action@v1
+      - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2
+      - uses: technote-space/get-diff-action@98fd8d380c6026fd0564d5a6f98fa2cf5c100c95 # v1
         with:
           SUFFIX_FILTER: |
             .go
@@ -39,7 +39,7 @@ jobs:
             sed -i.bak "/$(echo $filename | sed 's/\//\\\//g')/d" coverage.txt
           done
         if: "env.GIT_DIFF != ''"
-      - uses: codecov/codecov-action@v1
+      - uses: codecov/codecov-action@29386c70ef20e286228c72b668a06fd0e8399192 # v1
         with:
           file: ./coverage.txt # optional
           fail_ci_if_error: true
@@ -51,8 +51,8 @@ jobs:
       - name: Setup env for GO
         run: echo "::add-path::$(go env GOPATH)/bin"
         shell: bash
-      - uses: actions/checkout@v2
-      - uses: technote-space/get-diff-action@v1
+      - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2
+      - uses: technote-space/get-diff-action@98fd8d380c6026fd0564d5a6f98fa2cf5c100c95 # v1
         with:
           SUFFIX_FILTER: |
             .go