diff --git a/node/release_template.yml b/node/release_template.yml
index ee5eb93..40fb559 100644
--- a/node/release_template.yml
+++ b/node/release_template.yml
@@ -17,7 +17,7 @@ jobs:
       release_created: ${{ steps.release.outputs.release_created }}
     steps:
       - id: release
-        uses: googleapis/release-please-action@v4
+        uses: googleapis/release-please-action@a02a34c4d625f9be7cb89156071d8567266a2445 # v4
         with:
           target-branch: RELEASE_BRANCH
 
diff --git a/ruby/publish/action.yml b/ruby/publish/action.yml
index dfc0437..711e99d 100644
--- a/ruby/publish/action.yml
+++ b/ruby/publish/action.yml
@@ -53,7 +53,7 @@ runs:
         private_key: ${{ inputs.app_private_key }}
 
     - name: Setup Ruby
-      uses: ruby/setup-ruby@v1
+      uses: ruby/setup-ruby@dffc446db9ba5a0c4446edb5bca1c5c473a806c5 # v1
       with:
         ruby-version: '3.2'
         rubygems: ${{ inputs.rubygems_version }}
@@ -132,7 +132,7 @@ runs:
         dry_run: ${{ inputs.dry_run }}
 
     - name: Publish the gem
-      uses: rubygems/release-gem@v1
+      uses: rubygems/release-gem@a25424ba2ba8b387abc8ef40807c2c85b96cbe32 # v1
       if: inputs.dry_run == 'false'
       with:
         await-release: false
diff --git a/setup/action.yml b/setup/action.yml
index d674c65..617c69e 100644
--- a/setup/action.yml
+++ b/setup/action.yml
@@ -20,13 +20,13 @@ runs:
   using: composite
   steps:
   - name: configure aws credentials
-    uses: aws-actions/configure-aws-credentials@v4
+    uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4
     with:
       role-to-assume: ${{ inputs.aws_role_arn }}
       role-session-name: release-session
       aws-region: ${{ inputs.aws_region_name }}
   - name: Read secrets from AWS Secrets Manager into environment variables
-    uses: aws-actions/aws-secretsmanager-get-secrets@v2
+    uses: aws-actions/aws-secretsmanager-get-secrets@5e19ff380d035695bdd56bbad320ca535c9063f2 # v2
     with:
       secret-ids: |
         ${{ inputs.aws_secret_id }}