diff --git a/.github/workflows/update-pages.yml b/.github/workflows/update-pages.yml
index a9f4af05..0570c195 100644
--- a/.github/workflows/update-pages.yml
+++ b/.github/workflows/update-pages.yml
@@ -25,10 +25,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
       - name: Checkout gh-pages
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           ref: gh-pages
           path: gh-pages
@@ -49,7 +49,7 @@ jobs:
 
       - name: Upload Artifacts
         if: github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch'
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
         with:
           name: gh-pages
           if-no-files-found: error  # 'warn' or 'ignore' are also available, defaults to `warn`
@@ -62,7 +62,7 @@ jobs:
           (github.event_name == 'push' && github.ref == 'refs/heads/master') ||
           github.event_name == 'schedule' ||
           github.event_name == 'workflow_dispatch'
-        uses: actions-js/push@v1.5
+        uses: actions-js/push@5a7cbd780d82c0c937b5977586e641b2fd94acc5  # v1.5
         with:
           github_token: ${{ secrets.GH_BOT_TOKEN }}
           author_email: ${{ secrets.GH_BOT_EMAIL }}