diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 9d237ec..c58ee6f 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -12,9 +12,9 @@ jobs:
   update:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
-    - uses: cachix/install-nix-action@v31
+    - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
       with:
         extra_nix_config: |
           accept-flake-config = true
diff --git a/.github/workflows/update-data.yml b/.github/workflows/update-data.yml
index a8dc9b7..f92ce7b 100644
--- a/.github/workflows/update-data.yml
+++ b/.github/workflows/update-data.yml
@@ -16,9 +16,9 @@ jobs:
   update:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
-    - uses: cachix/install-nix-action@v31
+    - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
       with:
         extra_nix_config: |
           accept-flake-config = true
@@ -41,7 +41,7 @@ jobs:
         git rm -f --cached flake.lock
 
     - name: Create Pull Request
-      uses: peter-evans/create-pull-request@v7
+      uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7
       with:
         title: 'Update the library lists'
         commit-message: 'chore: Update the library lists'