diff --git a/.github/actions/install-deps/action.yml b/.github/actions/install-deps/action.yml
index 524b190fa7..969aaeb80e 100644
--- a/.github/actions/install-deps/action.yml
+++ b/.github/actions/install-deps/action.yml
@@ -35,7 +35,7 @@ runs:
         ruby-version: 3.4.8
         bundler-cache: true
 
-    - uses: actions/setup-java@v5
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
       with:
         distribution: "temurin"
         java-version: "17"
diff --git a/.github/workflows/auto-update-documentation.yml b/.github/workflows/auto-update-documentation.yml
index 8f5fee7884..80eb83634e 100644
--- a/.github/workflows/auto-update-documentation.yml
+++ b/.github/workflows/auto-update-documentation.yml
@@ -31,7 +31,7 @@ jobs:
     runs-on: ubuntu-24.04
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup Dependencies
         run: |
@@ -78,10 +78,10 @@ jobs:
       VESPA_CLI_DOC_DIR: en/reference/clients/vespa-cli
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Install Vespa CLI
-        uses: vespa-engine/setup-vespa-cli-action@v1
+        uses: vespa-engine/setup-vespa-cli-action@6072462cfdaa5f704890dcfa9160759099e58469 # v1
 
       - name: Generate Vespa CLI Documentation
         id: update-docs
@@ -128,9 +128,9 @@ jobs:
       - update-vespa-cli-doc
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
         with:
           distribution: "temurin"
           java-version: "17"
diff --git a/.github/workflows/deploy-pages.yml b/.github/workflows/deploy-pages.yml
index 499785098c..830609e431 100644
--- a/.github/workflows/deploy-pages.yml
+++ b/.github/workflows/deploy-pages.yml
@@ -33,7 +33,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: Setup Ruby
         # https://github.com/ruby/setup-ruby/releases/tag/v1.207.0
         uses: ruby/setup-ruby@v1
@@ -51,7 +51,7 @@ jobs:
           JEKYLL_ENV: production
       - name: Upload artifact
         # Automatically uploads an artifact from the './_site' directory by default
-        uses: actions/upload-pages-artifact@v4
+        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4
 
   # Deployment job
   deploy:
diff --git a/.github/workflows/feed.yml b/.github/workflows/feed.yml
index 8c8117ab10..8d1476d8bb 100644
--- a/.github/workflows/feed.yml
+++ b/.github/workflows/feed.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
 
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
     - uses: ruby/setup-ruby@v1
       with:
@@ -36,7 +36,7 @@ jobs:
         bundle exec jekyll build -p _plugins-vespafeed
 
     - name: Setup Python
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
       with:
         python-version: '3.x'
 
@@ -45,7 +45,7 @@ jobs:
         pip3 install PyYAML mmh3 requests html5lib beautifulsoup4 markdownify tiktoken
 
     - name: Install Vespa CLI
-      uses: vespa-engine/setup-vespa-cli-action@v1
+      uses: vespa-engine/setup-vespa-cli-action@6072462cfdaa5f704890dcfa9160759099e58469 # v1
 
     - name: Feed docs site
       run: |
diff --git a/.github/workflows/verify-guides.yml b/.github/workflows/verify-guides.yml
index 425911a0fe..5512376817 100644
--- a/.github/workflows/verify-guides.yml
+++ b/.github/workflows/verify-guides.yml
@@ -25,7 +25,7 @@ jobs:
     steps:
       - uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - uses: ./.github/actions/install-deps
         with: