diff --git a/.github/workflows/basic.yml b/.github/workflows/basic.yml
index 30e0577..9105b1f 100644
--- a/.github/workflows/basic.yml
+++ b/.github/workflows/basic.yml
@@ -51,14 +51,14 @@ jobs:
       PUPPET_GEM_VERSION: ">= 7.0"
       OPENVOX_GEM_VERSION: ">= 7.0"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: install additional packages
         if: ${{ inputs.additional_packages != '' }}
         run: |
           sudo apt-get update
           sudo apt-get install -y ${{ inputs.additional_packages }}
       - name: Setup ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@6aaa311d81eba98ae12eaffbcb63296ace0efcde # v1.307.0
         with:
           ruby-version: '3.2'
           bundler-cache: true
@@ -92,14 +92,14 @@ jobs:
       OPENVOX_GEM_VERSION: "~> ${{ matrix.puppet }}.0"
     name: ${{ matrix.puppet }} (Ruby ${{ matrix.ruby }})
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: install additional packages
         if: ${{ inputs.additional_packages != '' }}
         run: |
           sudo apt-get update
           sudo apt-get install -y ${{ inputs.additional_packages }}
       - name: Setup ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@6aaa311d81eba98ae12eaffbcb63296ace0efcde # v1.307.0
         with:
           ruby-version: ${{ matrix.ruby }}
           bundler-cache: true
diff --git a/.github/workflows/beaker.yml b/.github/workflows/beaker.yml
index 265a44b..20e9b8f 100644
--- a/.github/workflows/beaker.yml
+++ b/.github/workflows/beaker.yml
@@ -111,14 +111,14 @@ jobs:
       OPENVOX_GEM_VERSION: ">= 7.0"
       BEAKER_STAGING_VERSION: ${{ inputs.beaker_staging_version }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: install additional packages
         if: ${{ inputs.additional_packages != '' }}
         run: |
           sudo apt-get update
           sudo apt-get install -y ${{ inputs.additional_packages }}
       - name: Setup ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@6aaa311d81eba98ae12eaffbcb63296ace0efcde # v1.307.0
         with:
           ruby-version: '3.2'
           bundler-cache: true
@@ -154,14 +154,14 @@ jobs:
       OPENVOX_GEM_VERSION: "~> ${{ matrix.puppet }}.0"
     name: ${{ matrix.puppet }} (Ruby ${{ matrix.ruby }})
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: install additional packages
         if: ${{ inputs.additional_packages != '' }}
         run: |
           sudo apt-get update
           sudo apt-get install -y ${{ inputs.additional_packages }}
       - name: Setup ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@6aaa311d81eba98ae12eaffbcb63296ace0efcde # v1.307.0
         with:
           ruby-version: ${{ matrix.ruby }}
           bundler-cache: true
@@ -188,7 +188,7 @@ jobs:
         include: ${{fromJson(needs.setup_matrix.outputs.puppet_beaker_test_matrix)}}
     name: "${{ matrix.name }}"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: disable apparmor
         run: |
           # https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2093797
@@ -212,7 +212,7 @@ jobs:
           sudo apt-get install -y --no-install-recommends vagrant vagrant-libvirt libvirt-daemon-system libvirt-daemon qemu-system-x86 qemu-utils dnsmasq
           sudo chmod 666 /var/run/libvirt/libvirt-sock
       - name: Setup ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@6aaa311d81eba98ae12eaffbcb63296ace0efcde # v1.307.0
         with:
           ruby-version: '3.2'
           bundler-cache: true
diff --git a/.github/workflows/create_tag.yml b/.github/workflows/create_tag.yml
index d8e69d7..1113091 100644
--- a/.github/workflows/create_tag.yml
+++ b/.github/workflows/create_tag.yml
@@ -57,12 +57,12 @@ jobs:
     if: github.repository_owner == inputs.allowed_owner
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ inputs.base-branch }}
           ssh-key: "${{ secrets.ssh_private_key }}"
       - name: Setup Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@6aaa311d81eba98ae12eaffbcb63296ace0efcde # v1.307.0
         with:
           ruby-version: '3.4'
           bundler-cache: true
diff --git a/.github/workflows/prepare_release.yml b/.github/workflows/prepare_release.yml
index fa73a8a..e647feb 100644
--- a/.github/workflows/prepare_release.yml
+++ b/.github/workflows/prepare_release.yml
@@ -62,11 +62,11 @@ jobs:
     if: github.repository_owner == inputs.allowed_owner
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ inputs.base-branch }}
       - name: Setup Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@6aaa311d81eba98ae12eaffbcb63296ace0efcde # v1.307.0
         with:
           ruby-version: '3.3'
           bundler-cache: true
@@ -108,7 +108,7 @@ jobs:
           git config --global commit.gpgsign true
       - name: Create pull Request
         id: cpr
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           commit-message: "Release ${{ inputs.version }}"
           branch: release-prep
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index df43fac..6c31b9b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,11 +38,11 @@ jobs:
     if: github.repository_owner == inputs.allowed_owner
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
       - name: Setup Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@6aaa311d81eba98ae12eaffbcb63296ace0efcde # v1.307.0
         with:
           ruby-version: '3.2'
           bundler-cache: true