diff --git a/.github/actions/artifact/download/action.yml b/.github/actions/artifact/download/action.yml
index 0b1ba20..187a2d2 100644
--- a/.github/actions/artifact/download/action.yml
+++ b/.github/actions/artifact/download/action.yml
@@ -18,7 +18,7 @@ runs:
   using: composite
   steps:
     - name: Download artifact from github
-      uses: actions/download-artifact@v4.1.7
+      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
       if: ${{ inputs.force-use-github == 'true' || runner.environment == 'github-hosted' }}
       with:
         name: ${{ inputs.name }}
diff --git a/.github/actions/artifact/upload/action.yml b/.github/actions/artifact/upload/action.yml
index 70426c2..e18cc42 100644
--- a/.github/actions/artifact/upload/action.yml
+++ b/.github/actions/artifact/upload/action.yml
@@ -18,7 +18,7 @@ runs:
   using: composite
   steps:
     - name: Upload artifact to github
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       if: ${{ inputs.force-use-github == 'true' || runner.environment == 'github-hosted' }}
       with:
         name: ${{ inputs.name }}
diff --git a/.github/actions/pnpm/action.yml b/.github/actions/pnpm/action.yml
index 038b8ce..480c5db 100644
--- a/.github/actions/pnpm/action.yml
+++ b/.github/actions/pnpm/action.yml
@@ -12,7 +12,7 @@ runs:
   steps:
     - uses: pnpm/action-setup@v4
 
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
       with:
         node-version: ${{ inputs['node-version'] }}
         cache: pnpm
diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index ccaefc7..8e4ffd1 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -26,7 +26,7 @@ jobs:
 
       - uses: pnpm/action-setup@v4
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
         with:
           node-version-file: .node-version
           cache: pnpm
@@ -47,7 +47,7 @@ jobs:
         run: cargo codspeed build --features codspeed
 
       - name: Run benchmark
-        uses: CodSpeedHQ/action@v3
+        uses: CodSpeedHQ/action@dbda7111f8ac363564b0c51b992d4ce76bb89f2f # v4.5.2
         timeout-minutes: 30
         with:
           run: cargo codspeed run
diff --git a/.github/workflows/codecov.yml b/.github/workflows/codecov.yml
index c89b5f5..1a55350 100644
--- a/.github/workflows/codecov.yml
+++ b/.github/workflows/codecov.yml
@@ -38,7 +38,7 @@ jobs:
           RUST_MIN_STACK: 8388608
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: codecov
           path: lcov.info
@@ -58,13 +58,13 @@ jobs:
 
       - name: Download coverage file
         if: env.CODECOV_TOKEN
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
           name: codecov
 
       - name: Upload to codecov.io
         if: env.CODECOV_TOKEN
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           fail_ci_if_error: true
diff --git a/.github/workflows/release-npm.yml b/.github/workflows/release-npm.yml
index 88b5b52..f90854d 100644
--- a/.github/workflows/release-npm.yml
+++ b/.github/workflows/release-npm.yml
@@ -85,7 +85,7 @@ jobs:
     #    if: ${{ github.event_name == 'workflow_dispatch' }}
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           # This makes Actions fetch only one branch to release
           fetch-depth: 1
@@ -95,7 +95,7 @@ jobs:
         uses: ./.github/actions/pnpm
 
       - name: Download artifacts
-        uses: actions/download-artifact@v4.1.7
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
           path: artifacts
 
diff --git a/.github/workflows/release-plz.yml b/.github/workflows/release-plz.yml
index f18284f..20ca62d 100644
--- a/.github/workflows/release-plz.yml
+++ b/.github/workflows/release-plz.yml
@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-latest
     environment: crate
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           fetch-depth: 0
           ref: ${{ inputs.commit }}
diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml
index 2af76e5..36f0a7d 100644
--- a/.github/workflows/reusable-build.yml
+++ b/.github/workflows/reusable-build.yml
@@ -49,7 +49,7 @@ jobs:
       runner-labels: ${{ steps.upload-artifact.outputs.runner-labels || inputs.runner }}
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           ref: ${{ inputs.ref }}