diff --git a/.github/workflows/ansible-lint-github-hosted.yml b/.github/workflows/ansible-lint-github-hosted.yml
index 53179a6..9879ef5 100644
--- a/.github/workflows/ansible-lint-github-hosted.yml
+++ b/.github/workflows/ansible-lint-github-hosted.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Git checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Populate ansible config
         run: |
diff --git a/.github/workflows/gh-pages.yml b/.github/workflows/gh-pages.yml
index 9aae5b9..c8df826 100644
--- a/.github/workflows/gh-pages.yml
+++ b/.github/workflows/gh-pages.yml
@@ -19,15 +19,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - run: pip install mkdocs-material
       - run: mkdocs build
       - name: Setup Pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
         with:
           path: './site'
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
diff --git a/.github/workflows/issues-close-inactive.yml b/.github/workflows/issues-close-inactive.yml
index c1cb463..315db58 100644
--- a/.github/workflows/issues-close-inactive.yml
+++ b/.github/workflows/issues-close-inactive.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: close-issues
-        uses: actions-cool/issues-helper@v3
+        uses: actions-cool/issues-helper@a610082f8ac0cf03e357eb8dd0d5e2ba075e017e # v3
         with:
           actions: 'close-issues'
           token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/issues-find-inactive.yml b/.github/workflows/issues-find-inactive.yml
index 94ecddf..8bf1cfc 100644
--- a/.github/workflows/issues-find-inactive.yml
+++ b/.github/workflows/issues-find-inactive.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: check-inactive
-        uses: actions-cool/issues-helper@v3
+        uses: actions-cool/issues-helper@a610082f8ac0cf03e357eb8dd0d5e2ba075e017e # v3
         with:
           actions: 'check-inactive'
           token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/issues-notify-inactive.yml b/.github/workflows/issues-notify-inactive.yml
index 79ecb71..d94234b 100644
--- a/.github/workflows/issues-notify-inactive.yml
+++ b/.github/workflows/issues-notify-inactive.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Create comment
-        uses: actions-cool/issues-helper@v3
+        uses: actions-cool/issues-helper@a610082f8ac0cf03e357eb8dd0d5e2ba075e017e # v3
         if: github.event.label.name == 'inactive'
         with:
           actions: 'create-comment'
diff --git a/.github/workflows/issues-remove-inactive.yml b/.github/workflows/issues-remove-inactive.yml
index 1643fc3..96fda82 100644
--- a/.github/workflows/issues-remove-inactive.yml
+++ b/.github/workflows/issues-remove-inactive.yml
@@ -20,7 +20,7 @@ jobs:
     steps:
       - name: remove inactive
         if: github.event.issue.state == 'open' && github.event.issue.user != 'github-actions'
-        uses: actions-cool/issues-helper@v3
+        uses: actions-cool/issues-helper@a610082f8ac0cf03e357eb8dd0d5e2ba075e017e # v3
         with:
           actions: 'remove-labels'
           issue-number: ${{ github.event.issue.number }}
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 5ccc0ad..8be8b93 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -68,6 +68,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3
         with:
           sarif_file: results.sarif