diff --git a/.github/workflows/publish-ic-bn-lib-common.yml b/.github/workflows/publish-ic-bn-lib-common.yml
index d85b475..e713483 100644
--- a/.github/workflows/publish-ic-bn-lib-common.yml
+++ b/.github/workflows/publish-ic-bn-lib-common.yml
@@ -11,9 +11,9 @@ jobs:
       id-token: write # Required for OIDC token exchange
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
 
-      - uses: rust-lang/crates-io-auth-action@v1
+      - uses: rust-lang/crates-io-auth-action@b7e9a28eded4986ec6b1fa40eeee8f8f165559ec # v1
         id: auth
 
       - run: cargo publish --package ic-bn-lib-common
diff --git a/.github/workflows/publish-ic-bn-lib.yml b/.github/workflows/publish-ic-bn-lib.yml
index 0f85477..036e446 100644
--- a/.github/workflows/publish-ic-bn-lib.yml
+++ b/.github/workflows/publish-ic-bn-lib.yml
@@ -13,9 +13,9 @@ jobs:
       id-token: write # Required for OIDC token exchange
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
 
-      - uses: rust-lang/crates-io-auth-action@v1
+      - uses: rust-lang/crates-io-auth-action@b7e9a28eded4986ec6b1fa40eeee8f8f165559ec # v1
         id: auth
 
       - name: Set Cargo.toml version
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 91d5f35..b7b2bed 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6