diff --git a/.github/workflows/ai-assistance.yaml b/.github/workflows/ai-assistance.yaml
index 73ce0a1..85989f4 100644
--- a/.github/workflows/ai-assistance.yaml
+++ b/.github/workflows/ai-assistance.yaml
@@ -9,7 +9,7 @@ jobs:
     if: github.actor != 'ospo-renovate[bot]'
     runs-on: [ubuntu-latest]
     steps:
-      - uses: SAP/ai-assisted-github-actions/pr-summary@v3
+      - uses: SAP/ai-assisted-github-actions/pr-summary@8b4e4ef555450551045d43896ef25396ed387c4a # v3
         with:
           aicore-service-key: ${{ secrets.AICORE_SERVICE_KEY }}
           model: gpt-4o
@@ -22,7 +22,7 @@ jobs:
     if: github.actor != 'ospo-renovate[bot]'
     runs-on: [ubuntu-latest]
     steps:
-      - uses: SAP/ai-assisted-github-actions/pr-review@v3
+      - uses: SAP/ai-assisted-github-actions/pr-review@8b4e4ef555450551045d43896ef25396ed387c4a # v3
         with:
           aicore-service-key: ${{ secrets.AICORE_SERVICE_KEY }}
           model: gpt-4o
diff --git a/.github/workflows/build-cleanup.yaml b/.github/workflows/build-cleanup.yaml
index aa258e5..e61ed42 100644
--- a/.github/workflows/build-cleanup.yaml
+++ b/.github/workflows/build-cleanup.yaml
@@ -14,7 +14,7 @@ jobs:
     name: Clean up
     runs-on: [ubuntu-latest]
     steps:
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
         with:
           script: |
             github.rest.git.deleteRef({
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index fc5c081..6390931 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -18,7 +18,7 @@ jobs:
     if: ${{ !startsWith(github.head_ref || github.ref_name, 'release/') }}
     steps:
       - name: Checkout source branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           ref: ${{ env.SOURCE_BRANCH }}
           path: source-folder
@@ -28,7 +28,7 @@ jobs:
           git config --global user.email "${GITHUB_ACTOR}@users.noreply.github.com"
 
       - name: Setup Node (PR Summary)
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version-file: source-folder/pr-summary/.node-version
           cache: npm
@@ -41,7 +41,7 @@ jobs:
           npm prune --omit=dev
 
       - name: Setup Node (PR Review)
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version-file: source-folder/pr-review/.node-version
           cache: npm
@@ -64,7 +64,7 @@ jobs:
           fi
 
       - name: Checkout release branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           ref: ${{ env.RELEASE_BRANCH }}
           path: release-folder
@@ -97,7 +97,7 @@ jobs:
     if: ${{ github.ref_name != 'main' }}
     steps:
       - name: Checkout release branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           ref: ${{ env.RELEASE_BRANCH }}
       - name: Run the AI-assisted action (PR Summary)
@@ -122,7 +122,7 @@ jobs:
     if: ${{ github.ref_name == 'main' }}
     steps:
       - name: Checkout release branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           ref: ${{ env.RELEASE_BRANCH }}
       - name: Create tags for new version
diff --git a/.github/workflows/code-quality.yaml b/.github/workflows/code-quality.yaml
index c818ffc..884e81d 100644
--- a/.github/workflows/code-quality.yaml
+++ b/.github/workflows/code-quality.yaml
@@ -18,9 +18,9 @@ jobs:
         path: [pr-summary, pr-review]
     steps:
       - name: Checkout source branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 18
           cache: npm
@@ -41,9 +41,9 @@ jobs:
         path: [pr-summary, pr-review]
     steps:
       - name: Checkout source branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 18
           cache: npm