diff --git a/.github/workflows/automerge.yml b/.github/workflows/automerge.yml
index 0d370e2..995e76e 100644
--- a/.github/workflows/automerge.yml
+++ b/.github/workflows/automerge.yml
@@ -20,7 +20,7 @@ jobs:
     steps:
       - name: Generate token
         id: token
-        uses: tibdex/github-app-token@v2
+        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2
         with:
           app_id: ${{ secrets.TOKEN_EXCHANGE_APP }}
           installation_retrieval_mode: id
@@ -31,7 +31,7 @@ jobs:
 
       - name: Fetch metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v2
+        uses: dependabot/fetch-metadata@08eff52bf64351f401fb50d4972fa95b9f2c2d1b # v2
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/flake.yml b/.github/workflows/flake.yml
index e567ff7..33a98e0 100644
--- a/.github/workflows/flake.yml
+++ b/.github/workflows/flake.yml
@@ -17,13 +17,13 @@ jobs:
     steps:
       - name: Checkout source
         id: source
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
         with:
           token: ${{ secrets.BOT_ACCESS_TOKEN }}
 
       - name: Install nix
         id: nix
-        uses: cachix/install-nix-action@v31
+        uses: cachix/install-nix-action@56a7bb7b56d9a92d4fd1bc05758de7eea4a370a8 # v31
 
       - name: Update flake
         id: flake
@@ -34,7 +34,7 @@ jobs:
         run: git pull --autostash --rebase
 
       - name: Commit changes
-        uses: EndBug/add-and-commit@v9
+        uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9
         with:
           author_name: GitHub Actions
           author_email: github@webhippie.de
diff --git a/.github/workflows/general.yml b/.github/workflows/general.yml
index 31053ad..17aba8f 100644
--- a/.github/workflows/general.yml
+++ b/.github/workflows/general.yml
@@ -21,7 +21,7 @@ jobs:
     steps:
       - name: Checkout source
         id: source
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
 
       - name: Setup ruby
         id: ruby