diff --git a/.github/workflows/continuous-delivery.yml b/.github/workflows/continuous-delivery.yml
index 7631666..bb646c6 100644
--- a/.github/workflows/continuous-delivery.yml
+++ b/.github/workflows/continuous-delivery.yml
@@ -22,7 +22,7 @@ jobs:
         with:
           version: v0.8.12
       - name: Checkout code.
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - name: Release artifacts.
         run: earthly --ci --secret GH_TOKEN +release-artifacts --release "${GITHUB_REF_NAME}"
         env:
@@ -34,7 +34,7 @@ jobs:
       - name: Download Earthly v0.8.12.
         run: "sudo /bin/sh -c 'wget https://github.com/earthly/earthly/releases/download/v0.8.12/earthly-linux-amd64 -O /usr/local/bin/earthly && chmod +x /usr/local/bin/earthly'"
       - name: Checkout code.
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - name: Publish.
         run: earthly --ci --secret CARGO_REGISTRY_TOKEN +publish
         env:
diff --git a/.github/workflows/continuous-integration.yml b/.github/workflows/continuous-integration.yml
index d336040..e972f1f 100644
--- a/.github/workflows/continuous-integration.yml
+++ b/.github/workflows/continuous-integration.yml
@@ -19,7 +19,7 @@ jobs:
         with:
           version: v0.8.12
       - name: Checkout code.
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - name: Check formatting.
         run: earthly --ci +check-${{ matrix.language }}-formatting
   linting:
@@ -34,7 +34,7 @@ jobs:
         with:
           version: v0.8.12
       - name: Checkout code.
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - name: Check linting.
         run: earthly --ci +check-${{ matrix.language }}-linting
   compile:
@@ -46,7 +46,7 @@ jobs:
         with:
           version: v0.8.12
       - name: Checkout code.
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - name: Compile.
         run: earthly --ci +compile
   unit-test:
@@ -58,7 +58,7 @@ jobs:
         with:
           version: v0.8.12
       - name: Checkout code.
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
@@ -73,6 +73,6 @@ jobs:
         with:
           version: v0.8.12
       - name: Checkout code.
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - name: End to End test.
         run: earthly --ci +end-to-end-test
diff --git a/.github/workflows/conventional-commits.yml b/.github/workflows/conventional-commits.yml
index 16fafe3..c7d243f 100644
--- a/.github/workflows/conventional-commits.yml
+++ b/.github/workflows/conventional-commits.yml
@@ -16,7 +16,7 @@ jobs:
         with:
           version: v0.8.12
       - name: Checkout code.
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
diff --git a/.github/workflows/git-history.yml b/.github/workflows/git-history.yml
index 2f5d1d7..25bcff0 100644
--- a/.github/workflows/git-history.yml
+++ b/.github/workflows/git-history.yml
@@ -16,7 +16,7 @@ jobs:
         with:
           version: v0.8.12
       - name: Checkout code.
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
diff --git a/.github/workflows/github-actions-workflows.yml b/.github/workflows/github-actions-workflows.yml
index 34e9b38..4f013de 100644
--- a/.github/workflows/github-actions-workflows.yml
+++ b/.github/workflows/github-actions-workflows.yml
@@ -16,7 +16,7 @@ jobs:
         with:
           version: v0.8.12
       - name: Checkout code.
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - name: Check GitHub Actions workflows linting.
         run: earthly +check-github-actions-workflows-linting
   formatting:
@@ -28,6 +28,6 @@ jobs:
         with:
           version: v0.8.12
       - name: Checkout code.
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - name: Check formatting.
         run: earthly +check-yaml-formatting
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index b4c6660..73cb869 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -14,6 +14,6 @@ jobs:
   release-please:
     runs-on: ubuntu-latest
     steps:
-      - uses: googleapis/release-please-action@v4
+      - uses: googleapis/release-please-action@7987652d64b4581673a76e33ad5e98e3dd56832f # v4
         with:
           token: ${{ secrets.MY_RELEASE_PLEASE_TOKEN }}
diff --git a/Earthfile b/Earthfile
index 1949f33..213a520 100644
--- a/Earthfile
+++ b/Earthfile
@@ -88,7 +88,7 @@ check-python-formatting:
 
 
 golang-base:
-    FROM golang:1.22.1
+    FROM golang:1.22.1@sha256:0b55ab82ac2a54a6f8f85ec8b943b9e470c39e32c109b766bbc1b801f3fa8d3b
     WORKDIR "/conventional_commits_next_version"