diff --git a/.github/workflows/snjs.pr.yml b/.github/workflows/snjs.pr.yml
index 86072bd3118..3b61f267db3 100644
--- a/.github/workflows/snjs.pr.yml
+++ b/.github/workflows/snjs.pr.yml
@@ -79,7 +79,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Run E2E test suite
-        uses: convictional/trigger-workflow-and-wait@master
+        uses: convictional/trigger-workflow-and-wait@224756e4cc7fa0b711a281193496319f816cd880 # master
         with:
           owner: standardnotes
           repo: server
@@ -97,7 +97,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Run E2E vaults test suite
-        uses: convictional/trigger-workflow-and-wait@master
+        uses: convictional/trigger-workflow-and-wait@224756e4cc7fa0b711a281193496319f816cd880 # master
         with:
           owner: standardnotes
           repo: server
diff --git a/.github/workflows/web.release.prod.yml b/.github/workflows/web.release.prod.yml
index 04f26580cff..ee946e7e4a3 100644
--- a/.github/workflows/web.release.prod.yml
+++ b/.github/workflows/web.release.prod.yml
@@ -31,7 +31,7 @@ jobs:
       - name: Deploy static site to S3 bucket
         run: aws s3 sync packages/web/dist/ s3://app.standardnotes.com --delete
       - name: Invalidate CloudFront Cache
-        uses: chetan/invalidate-cloudfront-action@master
+        uses: chetan/invalidate-cloudfront-action@fce6f6f546fae2e9fe55f3bd1411063a908f2557 # master
         env:
           DISTRIBUTION: ${{ secrets.WEBAPP_CLOUDFRONT_COM_DISTRIBUTION_ID }}
           PATHS: '/*'
@@ -46,6 +46,6 @@ jobs:
 
     steps:
     - name: Run Discord Webhook
-      uses: johnnyhuy/actions-discord-git-webhook@main
+      uses: johnnyhuy/actions-discord-git-webhook@344d3543a4d21067013d88ab8ee47ad498d8bb98 # main
       with:
         webhook_url: ${{ secrets.DISCORD_WEBHOOK_URL }}