diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 83ad12ea..ab844269 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -43,7 +43,7 @@ jobs:
         run: cargo +nightly llvm-cov --all-features --workspace --lcov --output-path lcov.info
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5
         with:
           token: ${{ secrets.CODECOV_SECRET }}
           files: lcov.info
diff --git a/.github/workflows/stable.yml b/.github/workflows/stable.yml
index 474943f1..5c5fe624 100644
--- a/.github/workflows/stable.yml
+++ b/.github/workflows/stable.yml
@@ -62,7 +62,7 @@ jobs:
           prefix-key: v0-rust-stable
 
       - name: Check publishable
-        uses: katyo/publish-crates@v2
+        uses: katyo/publish-crates@02cc2f1ad653fb25c7d1ff9eb590a8a50d06186b # v2
         with:
           dry-run: true
           check-repo: false