diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5c6ff4f..cd37abf 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,11 +20,11 @@ jobs:
         go-version: [1.24.x]
 
     steps:
-      - uses: actions/checkout@v5.0.0
-      - uses: actions/setup-go@v6.1.0
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
         with:
           go-version: ${{ matrix.go-version }}
-      - uses: golangci/golangci-lint-action@v9.1.0
+      - uses: golangci/golangci-lint-action@e7fa5ac41e1cf5b7d48e45e42232ce7ada589601 # v9.1.0
         with:
           version: latest
       - run: go test -race -v ./...
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 88f9251..f99fdd7 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -17,7 +17,7 @@ jobs:
     steps:
       - name: Release Please
         id: release
-        uses: googleapis/release-please-action@v4.4.0
+        uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4.4.0
         with:
           token: ${{ secrets.GH_PAT_RELEASE_PLEASE_ACTION }}
           config-file: .github/.release-please-config.json