diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f2a411b..b4429f1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,7 +14,7 @@ jobs:
     outputs:
       REF: ${{ steps.generate-ref.outputs.ref }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - id: generate-ref
         name: Generate Ref
         run: |
@@ -30,7 +30,7 @@ jobs:
     name: Lint Dockerfile
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - name: Lint Dockerfile
         uses: docker://hadolint/hadolint:latest-debian
         with:
@@ -42,7 +42,7 @@ jobs:
       - lint-dockerfile
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - name: Fetch Versions
         uses: ./
         id: versions
@@ -71,7 +71,7 @@ jobs:
       - lint-dockerfile
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - run: docker version
       - run: docker images
       - run: docker build --no-cache -t $(echo "${DOCKER_IMAGE}:${REF}" | tr '[:upper:]' '[:lower:]') . -f Dockerfile-build
diff --git a/.github/workflows/craft-release.yaml b/.github/workflows/craft-release.yaml
index 5d082d8..295d413 100644
--- a/.github/workflows/craft-release.yaml
+++ b/.github/workflows/craft-release.yaml
@@ -11,7 +11,7 @@ jobs:
     name: Wait for status checks
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - run: sleep 13
       - name: 'Wait for status checks'
         id: waitforstatuschecks
@@ -34,8 +34,8 @@ jobs:
       docker_versions: ${{ steps.generate-version-strategy.outputs.docker_versions }}
       tag_versions: ${{ steps.generate-version-strategy.outputs.tag_versions }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: WyriHaximus/github-action-break-up-semver@v1
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
+      - uses: WyriHaximus/github-action-break-up-semver@04d837a8e3d26dff8f9cbf318c1b73e4f937b906 # v1
         id: breakupsemver
         with:
           version: ${{ env.MILESTONE }}
@@ -59,7 +59,7 @@ jobs:
       changelog: ${{ steps.changelog.outputs.changelog }}
     steps:
       - name: Generate changelog
-        uses: WyriHaximus/github-action-jwage-changelog-generator@v1
+        uses: WyriHaximus/github-action-jwage-changelog-generator@ede372670d88c4afefdffbcba5527e9e3a37778a # v1
         id: changelog
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -102,7 +102,7 @@ jobs:
         version: ${{ fromJson(needs.generate-version-strategy.outputs.tag_versions) }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - name: Create release/${{ matrix.version }} branch
         run: git checkout -b release/${{ matrix.version }} ${GITHUB_SHA}
       - run: sed -i 's/master/${{ matrix.version }}/g' Dockerfile
@@ -132,7 +132,7 @@ jobs:
       - run: git commit -F release-${{ matrix.version }}-changelog.md
       - run: git tag -F release-${{ matrix.version }}-changelog.md ${{ matrix.version }}
       - name: Push changes
-        uses: ad-m/github-push-action@v0.8.0
+        uses: ad-m/github-push-action@d91a481090679876dfc4178fef17f286781251df # v0.8.0
         with:
           tags: true
           branch: release/${{ matrix.version }}
@@ -162,7 +162,7 @@ jobs:
           prerelease: false
           commitish: release/${{ matrix.version }}
       - name: Delete release/${{ matrix.version }} branch
-        uses: dawidd6/action-delete-branch@v3
+        uses: dawidd6/action-delete-branch@d1efac9a6f7a9b408d4e8ff663a99c1fbac17b3f # v3
         with:
           github_token: ${{github.token}}
           branches: release/${{ matrix.version }}
diff --git a/.github/workflows/set-milestone-on-pr.yaml b/.github/workflows/set-milestone-on-pr.yaml
index 8e792f8..a586c73 100644
--- a/.github/workflows/set-milestone-on-pr.yaml
+++ b/.github/workflows/set-milestone-on-pr.yaml
@@ -13,7 +13,7 @@ jobs:
   set-milestone:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
         if: github.event.pull_request.milestone == null
       - name: 'Get Previous tag'
         if: github.event.pull_request.milestone == null