diff --git a/.github/workflows/update.yaml b/.github/workflows/update.yaml
index 6c281ca..e9842d1 100644
--- a/.github/workflows/update.yaml
+++ b/.github/workflows/update.yaml
@@ -27,26 +27,22 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        # v7.0.1
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Setup Python
-        # v7.0.0
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.12'
 
       - name: Setup pnpm
-        # v6.0.9
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with:
           version: 9
 
       - name: Setup Rust
-        # latest
-        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # latest
         with:
           toolchain: stable
 
diff --git a/action.yml b/action.yml
index 2a99848..3513e26 100644
--- a/action.yml
+++ b/action.yml
@@ -47,7 +47,7 @@ runs:
       shell: bash
 
     - if: env.COPIER_CHANGED == 'true' && hashFiles('pnpm-lock.yaml') != ''
-      uses: pnpm/action-setup@v4
+      uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
       with:
         version: 9
       continue-on-error: true
@@ -56,7 +56,7 @@ runs:
       shell: bash
       continue-on-error: true
     - if: env.COPIER_CHANGED == 'true' && hashFiles('js/pnpm-lock.yaml') != ''
-      uses: pnpm/action-setup@v4
+      uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
       with:
         version: 9
         package_json_file: js/package.json
@@ -67,7 +67,7 @@ runs:
       continue-on-error: true
 
     - if: env.COPIER_CHANGED == 'true' && hashFiles('Cargo.lock', 'rust/Cargo.lock') != ''
-      uses: dtolnay/rust-toolchain@stable
+      uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # latest
       with:
         toolchain: stable
       continue-on-error: true