diff --git a/.github/workflows/check-required-label.yml b/.github/workflows/check-required-label.yml
index 8a2090da7..a7e1d97c7 100644
--- a/.github/workflows/check-required-label.yml
+++ b/.github/workflows/check-required-label.yml
@@ -8,7 +8,7 @@ jobs:
   check-required-label:
     runs-on: ubuntu-latest
     steps:
-      - uses: mheap/github-action-required-labels@v5
+      - uses: mheap/github-action-required-labels@0ac283b4e65c1fb28ce6079dea5546ceca98ccbe # v5
         with:
           mode: exactly
           count: 1
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2c30eb66a..be810104e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -168,7 +168,7 @@ jobs:
         with:
           go-version: 1.25.x
       - name: Lint
-        uses: golangci/golangci-lint-action@v9
+        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9
         with:
           # If you change this, make sure to also update scripts/golangci-lint-shim.sh
           version: v2.4.0
diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml
index ef98d3f0c..8d7b4eb18 100644
--- a/.github/workflows/codespell.yml
+++ b/.github/workflows/codespell.yml
@@ -20,6 +20,6 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
       - name: Annotate locations with typos
-        uses: codespell-project/codespell-problem-matcher@v1
+        uses: codespell-project/codespell-problem-matcher@b80729f885d32f78a716c2f107b4db1025001c42 # v1
       - name: Codespell
-        uses: codespell-project/actions-codespell@v2
+        uses: codespell-project/actions-codespell@406322ec52dd7b488e48c1c4b82e2a8b3a1bf630 # v2
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9cd59863f..7c7a890c6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -152,7 +152,7 @@ jobs:
           go-version: 1.25.x
 
       - name: Run goreleaser
-        uses: goreleaser/goreleaser-action@v6
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6
         with:
           distribution: goreleaser
           version: v2
diff --git a/.github/workflows/sponsors.yml b/.github/workflows/sponsors.yml
index cdb2ce24d..645e554de 100644
--- a/.github/workflows/sponsors.yml
+++ b/.github/workflows/sponsors.yml
@@ -13,13 +13,13 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Generate Sponsors 💖
-        uses: JamesIves/github-sponsors-readme-action@v1.2.2
+        uses: JamesIves/github-sponsors-readme-action@a2d75a8d58b117b19777a910e284ccb082aaf117 # v1.2.2
         with:
           token: ${{ secrets.SPONSORS_TOKEN }}
           file: "README.md"
 
       - name: Create Pull Request 🚀
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8
         with:
           commit-message: "README.md: Update Sponsors"
           title: "README.md: Update Sponsors"