diff --git a/.github/workflows/codspeed.yml b/.github/workflows/codspeed.yml
index f950af1c5..dba5e7068 100644
--- a/.github/workflows/codspeed.yml
+++ b/.github/workflows/codspeed.yml
@@ -26,7 +26,7 @@ jobs:
         run: make build
 
       - name: Run benchmarks
-        uses: CodSpeedHQ/action@v3
+        uses: CodSpeedHQ/action@76578c2a7ddd928664caa737f0e962e3085d4e7c # v3.8.1
         with:
           token: ${{ secrets.CODSPEED_TOKEN }}
           run: uv run --frozen pytest tests/benchmarks --codspeed
diff --git a/.github/workflows/gh-pages-release.yml b/.github/workflows/gh-pages-release.yml
index b0a8a2f07..08d07a919 100644
--- a/.github/workflows/gh-pages-release.yml
+++ b/.github/workflows/gh-pages-release.yml
@@ -15,7 +15,7 @@ jobs:
       - name: Build docs
         run: make docs
       - name: Deploy release docs
-        uses: peaceiris/actions-gh-pages@v3
+        uses: peaceiris/actions-gh-pages@373f7f263a76c20808c831209c920827a82a2847 # v3.9.3
         with:
           personal_token: ${{ secrets.PERSONAL_TOKEN }}
           publish_dir: build/html
diff --git a/.github/workflows/gh-pages.yml b/.github/workflows/gh-pages.yml
index 61f77bc03..e612419b3 100644
--- a/.github/workflows/gh-pages.yml
+++ b/.github/workflows/gh-pages.yml
@@ -16,7 +16,7 @@ jobs:
       - name: Build docs
         run: make docs
       - name: Deploy latest docs
-        uses: peaceiris/actions-gh-pages@v3
+        uses: peaceiris/actions-gh-pages@373f7f263a76c20808c831209c920827a82a2847 # v3.9.3
         with:
           personal_token: ${{ secrets.PERSONAL_TOKEN }}
           publish_dir: build/html
diff --git a/.github/workflows/pypi.yml b/.github/workflows/pypi.yml
index 9f0406f9a..5dae4bb9b 100644
--- a/.github/workflows/pypi.yml
+++ b/.github/workflows/pypi.yml
@@ -15,7 +15,7 @@ jobs:
       - name: Build dists
         run: make build
       - name: Pypi Publish
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@6733eb7d741f0b11ec6a39b58540dab7590f9b7d # v1.14.0
         with:
           user: __token__
           password: ${{ secrets.pypi_password }}