diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml
index fe32cb9..e884d60 100644
--- a/.gitea/workflows/cd.yaml
+++ b/.gitea/workflows/cd.yaml
@@ -10,12 +10,12 @@ jobs:
     name: Release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
           fetch-depth: 0
       - name: Increment tag
         id: tag
-        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@0.1.23
+        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@e2d3fdbd16fb4b0ba78bec3003e6141dc5503628 # 0.1.23
         with:
           token: ${{ secrets.GITEA_TOKEN }}
       - uses: ./.gitea/actions/release-git-tag
diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index d72fb59..050539f 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -8,7 +8,7 @@ jobs:
     name: Dry-Run
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - name: Validate JSON
         uses: ./
         with:
diff --git a/.gitea/workflows/prerelease.yaml b/.gitea/workflows/prerelease.yaml
index b9ac217..4b00ab2 100644
--- a/.gitea/workflows/prerelease.yaml
+++ b/.gitea/workflows/prerelease.yaml
@@ -8,12 +8,12 @@ jobs:
     name: Release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
           fetch-depth: 0
       - name: Increment tag
         id: tag
-        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@0.1.23
+        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@e2d3fdbd16fb4b0ba78bec3003e6141dc5503628 # 0.1.23
         with:
           token: ${{ secrets.GITEA_TOKEN }}
           prerelease: true
diff --git a/action.yml b/action.yml
index 2758de1..5cfbdbe 100644
--- a/action.yml
+++ b/action.yml
@@ -10,7 +10,7 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - uses: actions/setup-node@v5
+    - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
       with:
         node-version: "latest"
     - name: Extract schema