diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml
index 0ae65fe25556483b90f71c07a0a336170b66d93c..a7b6485e6b5f89cf5a566cf9f5058dd8e72b0d23 100644
--- a/.github/workflows/cla.yml
+++ b/.github/workflows/cla.yml
@@ -22,7 +22,7 @@ jobs:
           github.event.comment.body == 'recheck' ||
           github.event.comment.body == 'I have read the Contributor License Agreement (CLA) and hereby sign the CLA.' ||
           github.event_name == 'pull_request_target'
-        uses: contributor-assistant/github-action@v2.6.1
+        uses: contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08 # v2.6.1
         env:
           GITHUB_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
         with:
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index afc6427ff864eaf4929b831c7df23a2699304528..ff40f751d372d17bf458a33efc7776f258739cf3 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -20,7 +20,7 @@ jobs:
   triage:
     runs-on: ubuntu-latest
     steps:
-      - uses: github/issue-labeler@v3.4
+      - uses: github/issue-labeler@c1b0f9f52a63158c4adc09425e858e87b32e9685 # v3.4
         with:
           configuration-path: .github/labeler.yml
           enable-versioned-regex: 0
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index ede4752153124701ff75e3780f12d179f98fe530..1e711cfcaa5beb465f7dabacdb10157f4f35ac68 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -11,7 +11,7 @@ jobs:
     outputs:
       should_run: ${{ steps.check.outputs.should_run }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           fetch-depth: 1
       - id: check
diff --git a/.github/workflows/schema-update.yml b/.github/workflows/schema-update.yml
index bc7e19b67f5021e8d3ff00342a062f2c6c000e86..bc1a69c68273c007a764c268958858be3b62bcd2 100644
--- a/.github/workflows/schema-update.yml
+++ b/.github/workflows/schema-update.yml
@@ -10,10 +10,10 @@ jobs:
   update-schema:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
         with:
           go-version-file: go.mod
       - run: go run . schema > ./schema.json