diff --git a/.github/actions/clean-release-notes/action.yml b/.github/actions/clean-release-notes/action.yml
index 5b30abd..0a0e1e3 100644
--- a/.github/actions/clean-release-notes/action.yml
+++ b/.github/actions/clean-release-notes/action.yml
@@ -49,7 +49,7 @@ runs:
     # The Go source lives next to this action.yml, so ${{ github.action_path }}
     # already points at everything we need. No separate checkout required.
     - name: Set up Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
       with:
         # The go.mod shipped with the action pins the required Go version.
         go-version-file: ${{ github.action_path }}/go.mod
diff --git a/.github/actions/cleanup-release-draft/action.yml b/.github/actions/cleanup-release-draft/action.yml
index c425007..95dc7b9 100644
--- a/.github/actions/cleanup-release-draft/action.yml
+++ b/.github/actions/cleanup-release-draft/action.yml
@@ -44,7 +44,7 @@ runs:
 
     - name: Clean release notes
       if: steps.draft.outputs.found == 'true'
-      uses: gofiber/.github/.github/actions/clean-release-notes@main
+      uses: gofiber/.github/.github/actions/clean-release-notes@2a2c623de2cfdc4c6b52ecf52907be260a01949b # main
       with:
         release-id: ${{ steps.draft.outputs.id }}
       env:
diff --git a/.github/workflows/after-release.yml b/.github/workflows/after-release.yml
index a7e553c..6363e1c 100644
--- a/.github/workflows/after-release.yml
+++ b/.github/workflows/after-release.yml
@@ -55,7 +55,7 @@ jobs:
       matrix:
         repo: ${{ fromJson(needs.wait.outputs.matrix) }}
     steps:
-      - uses: gofiber/.github/.github/actions/trigger-dependabot@main
+      - uses: gofiber/.github/.github/actions/trigger-dependabot@2a2c623de2cfdc4c6b52ecf52907be260a01949b # main
         with:
           repo: ${{ matrix.repo }}
           token: ${{ secrets.dispatch-token }}
diff --git a/.github/workflows/weekly-release.yml b/.github/workflows/weekly-release.yml
index 2859325..23337e3 100644
--- a/.github/workflows/weekly-release.yml
+++ b/.github/workflows/weekly-release.yml
@@ -317,7 +317,7 @@ jobs:
           steps.draft.outputs.no-draft == 'false' &&
           steps.bump.outputs.is_major != 'true' &&
           steps.pending.outputs.pending != 'true'
-        uses: gofiber/.github/.github/actions/clean-release-notes@main
+        uses: gofiber/.github/.github/actions/clean-release-notes@2a2c623de2cfdc4c6b52ecf52907be260a01949b # main
         with:
           release-id: ${{ steps.draft.outputs.id }}
           bots: ${{ inputs.bot-logins }}