diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml
index e3b87887..0c168d8b 100644
--- a/.github/workflows/main.yaml
+++ b/.github/workflows/main.yaml
@@ -154,4 +154,4 @@ jobs:
     needs: [publish-maven-central, publish-github-packages]
     permissions:
       contents: write
-    uses: openfga/.github/.github/workflows/undraft-release.yml@main
+    uses: openfga/.github/.github/workflows/undraft-release.yml@835baf31562809ad9eb884c73efc5b79318f700f # pin@main
diff --git a/.github/workflows/pr-title-check.yml b/.github/workflows/pr-title-check.yml
index 748e0ddd..391d37f0 100644
--- a/.github/workflows/pr-title-check.yml
+++ b/.github/workflows/pr-title-check.yml
@@ -13,5 +13,5 @@ jobs:
   pr-title-check:
     permissions:
       pull-requests: read
-    uses: openfga/.github/.github/workflows/pr-title-check.yml@main
+    uses: openfga/.github/.github/workflows/pr-title-check.yml@835baf31562809ad9eb884c73efc5b79318f700f # pin@main
 
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 89d52f4b..4913b05e 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -36,7 +36,7 @@ jobs:
     if: |
       github.event_name == 'workflow_dispatch' ||
       startsWith(github.event.head_commit.message, 'release:')
-    uses: openfga/.github/.github/workflows/release-please.yml@main
+    uses: openfga/.github/.github/workflows/release-please.yml@835baf31562809ad9eb884c73efc5b79318f700f # pin@main
     with:
       trigger-event:   ${{ github.event_name }}
       bump-type:       ${{ inputs.bump-type || 'auto' }}