diff --git a/.github/workflows/fragment-conformance.yml b/.github/workflows/fragment-conformance.yml
index 3ddbe7d..c79f819 100644
--- a/.github/workflows/fragment-conformance.yml
+++ b/.github/workflows/fragment-conformance.yml
@@ -18,11 +18,11 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout specification
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: Checkout pinned QuandleDB implementation
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           repository: hyperpolymath/quandledb
           ref: f1d0010e4e614fcb2c8428e555b9cdbb279d4da7
@@ -31,7 +31,7 @@ jobs:
       - name: Record implementation revision
         run: git -C deps/quandledb rev-parse HEAD
       - name: Install Julia
-        uses: julia-actions/setup-julia@v2.7.0
+        uses: julia-actions/setup-julia@4c0cb0fce8556fdb04a90347310e5db8b1f98fb9  # v2.7.0
         with:
           version: '1.12.6'
       - name: Check fragment syntax, execution and explicit refusal
diff --git a/.github/workflows/rhodibot.yml b/.github/workflows/rhodibot.yml
index 29dc13e..255ddea 100644
--- a/.github/workflows/rhodibot.yml
+++ b/.github/workflows/rhodibot.yml
@@ -34,7 +34,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 1
       - name: Rhodibot — detect drift (no mutations)