diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 28af929c18a..dac1d160f77 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -10,18 +10,18 @@ jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with: # for gitlint
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
         with:
           python-version: ">=3.7"
           cache: pip
           cache-dependency-path: |
             .github/requirements.txt
             test/requirements*.txt
-      - uses: actions/cache@v4
+      - uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
         with:
           path: ~/.cache/pre-commit
           key: pre-commit-${{hashFiles('.pre-commit-config.yaml')}}
@@ -51,8 +51,8 @@ jobs:
           - dist: fedoradev
           - dist: ubuntu14
     steps:
-      - uses: actions/checkout@v4
-      - uses: googleapis/release-please-action@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: googleapis/release-please-action@7987652d64b4581673a76e33ad5e98e3dd56832f # v4.1.3
         with:
           config-file: .github/release-please-config.json
           manifest-file: .github/release-please-manifest.json
@@ -78,7 +78,7 @@ jobs:
           test/docker/entrypoint.sh
         env:
           NETWORK: ${{matrix.network}}
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
         with:
           path: |
             bash-completion-*.tar.xz
diff --git a/.github/workflows/update-docker-images.yml b/.github/workflows/update-docker-images.yml
index 84dddce2075..555b4bd7f83 100644
--- a/.github/workflows/update-docker-images.yml
+++ b/.github/workflows/update-docker-images.yml
@@ -28,13 +28,13 @@ jobs:
           - dist: fedoradev
           - dist: ubuntu14
     steps:
-      - uses: actions/checkout@v4
-      - uses: docker/login-action@v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
         with:
           registry: ghcr.io
           username: ${{github.repository_owner}}
           password: ${{secrets.GITHUB_TOKEN}}
-      - uses: docker/build-push-action@v6
+      - uses: docker/build-push-action@48aba3b46d1b1fec4febb7c5d0c644b249a11355 # v6.10.0
         with:
           context: test
           file: test/docker/${{matrix.dist}}/Dockerfile