diff --git a/.github/workflows/ci-php.yaml b/.github/workflows/ci-php.yaml
index f6f76d6..356f98b 100644
--- a/.github/workflows/ci-php.yaml
+++ b/.github/workflows/ci-php.yaml
@@ -46,12 +46,12 @@ jobs:
         uses: actions/checkout@v6.0.2
 
       - name: Set up PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # 2.37.1
         with:
           php-version: ${{ matrix.php }}
 
       - name: Install PHP Dependencies
-        uses: ramsey/composer-install@3.1.1
+        uses: ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520 # 3.1.1
 
       - name: Verify MariaDB connection
         run: |
diff --git a/.github/workflows/phpcs.yaml b/.github/workflows/phpcs.yaml
index ac3b689..217ec2c 100644
--- a/.github/workflows/phpcs.yaml
+++ b/.github/workflows/phpcs.yaml
@@ -22,12 +22,12 @@ jobs:
         uses: actions/checkout@v6.0.2
 
       - name: Set up PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # 2.37.1
         with:
           php-version: 8.3
 
       - name: Install PHP Dependencies
-        uses: ramsey/composer-install@3.1.1
+        uses: ramsey/composer-install@3cf229dc2919194e9e36783941438d17239e8520 # 3.1.1
 
       - name: Add error matcher
         run: echo "::add-matcher::$(pwd)/.github/checkstyle-problem-matcher.json"