diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 5c8fde6..1f5b8b4 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -20,24 +20,24 @@ jobs:
     needs: [build]
     steps:
       - name: Login to GitHub container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
       - name: Set up docker-buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
       - name: Build image to tar
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
           platforms: linux/arm64
           push: false
           tags: ghcr.io/apple/container-builder-shim/builder:test
           outputs: type=oci,dest=container-builder-shim.tar
       - name: Save artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: container-builder-shim
           path: container-builder-shim.tar
diff --git a/.github/workflows/common.yml b/.github/workflows/common.yml
index 98aff8c..fb23189 100644
--- a/.github/workflows/common.yml
+++ b/.github/workflows/common.yml
@@ -11,11 +11,11 @@ jobs:
     runs-on: [self-hosted, macos, tahoe, ARM64]
     timeout-minutes: 30
     steps: 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version: '1.25.5'
       - name: Checkout repository
-        uses: actions/checkout@v4 
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
       - name: Check formatting
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2a639b1..df91065 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -22,17 +22,17 @@ jobs:
       packages: write
     steps:
       - name: Login to GitHub container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
       - name: Set up docker-buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
       - name: Build Dockerfile and push image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
           platforms: linux/arm64
           push: true