diff --git a/.github/workflows/backward.yml b/.github/workflows/backward.yml
index 6927bde6..8f966ad1 100644
--- a/.github/workflows/backward.yml
+++ b/.github/workflows/backward.yml
@@ -26,7 +26,7 @@ jobs:
 
     steps:
       - name: checkout tkey repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           path: tkey
 
@@ -35,7 +35,7 @@ jobs:
           cd ./tkey
 
       - name: Set up node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: ${{ matrix.node }}
           cache: "npm"
@@ -46,7 +46,7 @@ jobs:
           npm run pack:lerna
 
       - name: Clone comp tests
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           repository: tkey/backward-compatibility-tests
           path: backward-compatibility-tests
diff --git a/.github/workflows/browserTests.yml b/.github/workflows/browserTests.yml
index 5b195d8a..79cbd92e 100644
--- a/.github/workflows/browserTests.yml
+++ b/.github/workflows/browserTests.yml
@@ -26,10 +26,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Setup Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: "npm"
diff --git a/.github/workflows/buildMocks.yml b/.github/workflows/buildMocks.yml
index e917f399..d70d736c 100644
--- a/.github/workflows/buildMocks.yml
+++ b/.github/workflows/buildMocks.yml
@@ -21,12 +21,12 @@ jobs:
 
     steps:
       - name: checkout tkey repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           path: ./tkey
 
       - name: Set up node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: ${{ matrix.node }}
           cache: "npm"
@@ -38,7 +38,7 @@ jobs:
           npm run pack:lerna
 
       - name: Clone comp tests
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           repository: tkey/backward-compatibility-tests
           path: ./backward-compatibility-tests
@@ -59,7 +59,7 @@ jobs:
           cd ./backward-compatibility-tests
           npm run build-mocks
 
-      - uses: EndBug/add-and-commit@v9
+      - uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9.1.4
         with:
           author_name: Auto
           branch: master
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index eb6a2c7c..17d9a4de 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,10 +13,10 @@ jobs:
 
     steps:
       - name: Check out Git repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Set up node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: ${{ matrix.node }}
           cache: "npm"