diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml
index 73ee081..8c4cd44 100644
--- a/.gitea/workflows/cd.yaml
+++ b/.gitea/workflows/cd.yaml
@@ -10,7 +10,7 @@ jobs:
     name: Release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
         with:
           fetch-depth: 0
       - name: Increment tag
diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 83f7839..e37790c 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -10,7 +10,7 @@ jobs:
       - ubuntu-latest
       - linux_amd64
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
       - name: Setup Trivy
         uses: ./setup-trivy
         with:
@@ -25,7 +25,7 @@ jobs:
       - ubuntu-latest
       - linux_amd64
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
       - uses: ./setup-trivy
         with:
           version: v0.66.0
diff --git a/.gitea/workflows/prerelease.yaml b/.gitea/workflows/prerelease.yaml
index be5c620..79032a4 100644
--- a/.gitea/workflows/prerelease.yaml
+++ b/.gitea/workflows/prerelease.yaml
@@ -8,7 +8,7 @@ jobs:
     name: Prerelease
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
         with:
           fetch-depth: 0
       - name: Increment tag
diff --git a/setup-db/action.yaml b/setup-db/action.yaml
index e0ec698..27191bc 100644
--- a/setup-db/action.yaml
+++ b/setup-db/action.yaml
@@ -19,7 +19,7 @@ runs:
       run: |
         echo "current-date=$(date +%Y-%m-%d)" >> $GITHUB_OUTPUT
     - id: restore-db
-      uses: actions/cache@v4
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       with:
         path: ${{ inputs.cache-dir }}
         key: trivy-db-${{ steps.current-date.outputs.current-date }}
diff --git a/setup-trivy/action.yaml b/setup-trivy/action.yaml
index a04c955..a9f18af 100644
--- a/setup-trivy/action.yaml
+++ b/setup-trivy/action.yaml
@@ -20,7 +20,7 @@ runs:
   steps:
     - name: Cache Trivy binary
       id: cache-trivy
-      uses: actions/cache@v4
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       with:
         path: /usr/local/bin/trivy
         key: trivy-${{ inputs.version }}-${{ inputs.architecture }}