diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 663459e6..62ae9589 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -14,7 +14,7 @@ jobs:
     name: "PHP Lints"
     steps:
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@cf4cade2721270509d5b1c766ab3549210a39a2a # 2.33.0
         with:
           php-version: 8.3
 
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 6d94ce86..719e9314 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -18,7 +18,7 @@ jobs:
     name: "PHP ${{ matrix.php-versions }} test on ${{ matrix.operating-system }}"
     steps:
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@cf4cade2721270509d5b1c766ab3549210a39a2a # 2.33.0
         with:
           php-version: ${{ matrix.php-versions }}
           tools: composer
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 3d15ced4..f6c58001 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -22,11 +22,11 @@ jobs:
           persist-credentials: false
 
       - name: Install the latest version of uv
-        uses: astral-sh/setup-uv@v6
+        uses: astral-sh/setup-uv@c7f87aa956e4c323abf06d5dec078e358f6b4d04 # 6.0.0
         with:
           enable-cache: false
 
       - name: Run zizmor
-        run: uvx zizmor@1.5.2 --format plain .
+        run: uvx zizmor@1.7.0 --format plain .
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}