diff --git a/.github/workflows/release-python.yml b/.github/workflows/release-python.yml
index 1d381f4..c89e002 100644
--- a/.github/workflows/release-python.yml
+++ b/.github/workflows/release-python.yml
@@ -76,14 +76,14 @@ jobs:
         name: all-dist-${{ github.run_id }}
         path: dist/
     - name: Publish package distributions to TestPyPI
-      uses: pypa/gh-action-pypi-publish@release/v1
+      uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # release/v1
       with:
         repository-url: https://test.pypi.org/legacy/
         skip-existing: true
         attestations: ${{ env.DRY_RUN }}
     - name: Publish distribution 📦 to PyPI
       if: startsWith(env.DRY_RUN, 'false')
-      uses: pypa/gh-action-pypi-publish@release/v1
+      uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # release/v1
 
   post-publish:
     needs: [publish]
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index ab15d79..2a47f95 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -17,7 +17,7 @@ jobs:
           python-version: ${{ matrix.python-version }}
           allow-prereleases: true
       - name: Start MongoDB
-        uses: supercharge/mongodb-github-action@1.12.0
+        uses: supercharge/mongodb-github-action@90004df786821b6308fb02299e5835d0dae05d0d # 1.12.0
         with:
           mongodb-version: "4.4"
           mongodb-replica-set: test-rs