diff --git a/.github/workflows/cs.yaml b/.github/workflows/cs.yaml
index 87b6801..61c6e08 100644
--- a/.github/workflows/cs.yaml
+++ b/.github/workflows/cs.yaml
@@ -30,20 +30,20 @@ jobs:
 
         steps:
             -   name: "Check out repository code"
-                uses: "actions/checkout@v5"
+                uses: "actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8" # v5.0.0
 
             -   name: "Setup PHP"
-                uses: "shivammathur/setup-php@v2"
+                uses: "shivammathur/setup-php@bf6b4fbd49ca58e4608c9c89fba0b8d90bd2a39f" # master
                 with:
                     php-version: "${{ matrix.php }}"
                     tools: "composer"
 
             -   name: "Install Composer dependencies"
-                uses: "ramsey/composer-install@v3"
+                uses: "ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520" # 3.1.1
 
             -   name: "Install PHP-CS-Fixer Composer dependencies"
                 if: "! matrix.skip_static_checks"
-                uses: "ramsey/composer-install@v3"
+                uses: "ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520" # 3.1.1
                 with:
                     working-directory: "vendor-bin/php-cs-fixer"
 
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index eed1d77..deaa2c6 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -33,10 +33,10 @@ jobs:
 
         steps:
             -   name: "Check out repository code"
-                uses: "actions/checkout@v5"
+                uses: "actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8" # v5.0.0
 
             -   name: "Setup PHP"
-                uses: "shivammathur/setup-php@v2"
+                uses: "shivammathur/setup-php@bf6b4fbd49ca58e4608c9c89fba0b8d90bd2a39f" # master
                 with:
                     php-version: "${{ matrix.php }}"
                     tools: "composer, flex"
@@ -46,7 +46,7 @@ jobs:
                 run: "echo \"SYMFONY_REQUIRE=${{ matrix.symfony }}\" >> $GITHUB_ENV"
 
             -   name: "Install Composer dependencies"
-                uses: "ramsey/composer-install@v3"
+                uses: "ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520" # 3.1.1
                 with:
                     dependency-versions: "${{ matrix.dependency-versions }}"
 
@@ -64,17 +64,17 @@ jobs:
 
         steps:
             -   name: "Check out repository code"
-                uses: "actions/checkout@v5"
+                uses: "actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8" # v5.0.0
 
             -   name: "Setup PHP"
-                uses: "shivammathur/setup-php@v2"
+                uses: "shivammathur/setup-php@bf6b4fbd49ca58e4608c9c89fba0b8d90bd2a39f" # master
                 with:
                     php-version: "${{ matrix.php }}"
                     tools: "composer"
                     coverage: "xdebug"
 
             -   name: "Install Composer dependencies"
-                uses: "ramsey/composer-install@v3"
+                uses: "ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520" # 3.1.1
 
             -   name: "Run tests and mutation testing"
                 run: "make infection"