diff --git a/.github/workflows/bump-asf-reference.yml b/.github/workflows/bump-asf-reference.yml
index 9d0f06b..f92d9ac 100644
--- a/.github/workflows/bump-asf-reference.yml
+++ b/.github/workflows/bump-asf-reference.yml
@@ -25,21 +25,21 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4.2.2
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         show-progress: false
         token: ${{ env.PUSH_GITHUB_TOKEN }}
 
     - name: Fetch latest ArchiSteamFarm release
       id: asf-release
-      uses: rez0n/actions-github-release@v2.0
+      uses: rez0n/actions-github-release@27a57820ee808f8fd940c8a9d1f7188f854aa2b5 # v2.0
       env:
         repository: JustArchiNET/ArchiSteamFarm
         token: ${{ secrets.GITHUB_TOKEN }}
         type: ${{ env.RELEASE_TYPE }}
 
     - name: Import GPG key for signing
-      uses: crazy-max/ghaction-import-gpg@v6.3.0
+      uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec # v6.3.0
       if: ${{ env.GPG_PRIVATE_KEY != null }}
       with:
         gpg_private_key: ${{ env.GPG_PRIVATE_KEY }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 53489de..983ac02 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,13 +22,13 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4.2.2
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         show-progress: false
         submodules: recursive
 
     - name: Setup .NET Core
-      uses: actions/setup-dotnet@v4.3.1
+      uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
       with:
         dotnet-version: ${{ env.DOTNET_SDK_VERSION }}
 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index c3bb8cb..3417d23 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -26,13 +26,13 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4.2.2
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         show-progress: false
         submodules: recursive
 
     - name: Setup .NET Core
-      uses: actions/setup-dotnet@v4.3.1
+      uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
       with:
         dotnet-version: ${{ env.DOTNET_SDK_VERSION }}
 
@@ -41,7 +41,7 @@ jobs:
 
     - name: Parse plugin name from Directory.Build.props
       id: plugin-name
-      uses: mavrosxristoforos/get-xml-info@2.0
+      uses: mavrosxristoforos/get-xml-info@afaa5058ead44cfaff92c6a861b46dd7a8929f60 # 2.0
       with:
         xml-file: 'Directory.Build.props'
         xpath: '//PluginName'
@@ -129,7 +129,7 @@ jobs:
         }
 
     - name: Upload plugin artifact
-      uses: actions/upload-artifact@v4.6.2
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         if-no-files-found: error
         name: ${{ matrix.os }}_${{ steps.plugin-name.outputs.info }}
@@ -145,18 +145,18 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4.2.2
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         show-progress: false
 
     - name: Download plugin artifact from ubuntu-latest
-      uses: actions/download-artifact@v4.3.0
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
       with:
         name: ubuntu-latest_${{ needs.publish.outputs.PLUGIN_NAME }}
         path: out
 
     - name: Import GPG key for signing
-      uses: crazy-max/ghaction-import-gpg@v6.3.0
+      uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec # v6.3.0
       if: ${{ env.GPG_PRIVATE_KEY != null }}
       with:
         gpg_private_key: ${{ env.GPG_PRIVATE_KEY }}
@@ -177,14 +177,14 @@ jobs:
         )
 
     - name: Upload SHA512SUMS
-      uses: actions/upload-artifact@v4.6.2
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         if-no-files-found: error
         name: SHA512SUMS
         path: out/SHA512SUMS
 
     - name: Upload SHA512SUMS.sign
-      uses: actions/upload-artifact@v4.6.2
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       if: ${{ env.GPG_PRIVATE_KEY != null }}
       with:
         if-no-files-found: error
@@ -192,7 +192,7 @@ jobs:
         path: out/SHA512SUMS.sign
 
     - name: Create GitHub release
-      uses: ncipollo/release-action@v1.18.0
+      uses: ncipollo/release-action@bcfe5470707e8832e12347755757cec0eb3c22af # v1.18.0
       with:
         allowUpdates: true
         artifactErrorsFailBuild: true