diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index c117684..921dd3f 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -33,12 +33,12 @@ jobs:
 
     steps:
       - name: Setup QEMU
-        uses: docker/setup-qemu-action@v1
+        uses: docker/setup-qemu-action@27d0a4f181a40b142cce983c5393082c365d1480 # v1
         with:
           platforms: all
 
       - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9 # v1
         with:
           version: ${{ env.DOCKER_BUILDX_VERSION }}
           install: true
@@ -65,7 +65,7 @@ jobs:
           path: _output/**
 
       - name: Login to Upbound
-        uses: docker/login-action@v1
+        uses: docker/login-action@dd4fa0671be5250ee6f50aedf4cb05514abda2c7 # v1
         if: env.XPKG_ACCESS_ID != ''
         with:
           registry: xpkg.upbound.io
diff --git a/.github/workflows/tag.yml b/.github/workflows/tag.yml
index 48d7764..6f12ffd 100644
--- a/.github/workflows/tag.yml
+++ b/.github/workflows/tag.yml
@@ -19,7 +19,7 @@ jobs:
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Create Tag
-        uses: negz/create-tag@v1
+        uses: negz/create-tag@39bae1e0932567a58c20dea5a1a0d18358503320 # v1
         with:
           version: ${{ github.event.inputs.version }}
           message: ${{ github.event.inputs.message }}
diff --git a/.github/workflows/yamllint.yaml b/.github/workflows/yamllint.yaml
index 16a78d3..3ebf7cf 100644
--- a/.github/workflows/yamllint.yaml
+++ b/.github/workflows/yamllint.yaml
@@ -5,9 +5,9 @@ jobs:
     name: runner / yamllint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4
       - name: yamllint
-        uses: reviewdog/action-yamllint@v1.9.0
+        uses: reviewdog/action-yamllint@b00d2ab43a360f25846817aa225d3b39001affc3 # v1.9.0
         with:
           reporter: github-pr-review
           filter_mode: nofilter