diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 3640f9b9a..e017d8f14 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -153,10 +153,10 @@ jobs:
       - name: Set image prefix (lowercase)
         run: echo "IMAGE_PREFIX=$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_ENV"
 
-      - uses: docker/setup-buildx-action@v4
+      - uses: docker/setup-buildx-action@v4.1.0
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.2.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -164,7 +164,7 @@ jobs:
 
       - name: Build & push by digest
         id: build
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v7.2.0
         with:
           context: ${{ matrix.target.context }}
           file: ${{ matrix.target.file }}
@@ -221,10 +221,10 @@ jobs:
           pattern: digests-${{ matrix.service }}-*
           merge-multiple: true
 
-      - uses: docker/setup-buildx-action@v4
+      - uses: docker/setup-buildx-action@v4.1.0
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.2.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 8e718ee90..9938d9b32 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -47,14 +47,14 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@v4.36.2
         with:
           languages: ${{ matrix.language }}
           build-mode: none
           config-file: ./.github/codeql/codeql-config.yml
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@v4.36.2
         with:
           category: '/language:${{ matrix.language }}'
 
@@ -79,7 +79,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@v4.36.2
         with:
           languages: java-kotlin
           build-mode: manual
@@ -100,6 +100,6 @@ jobs:
             :libs:kotlin-common:compileKotlin
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@v4.36.2
         with:
           category: '/language:java-kotlin'
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 973c2f4d4..ded1feade 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -41,7 +41,7 @@ jobs:
           publish_results: true
 
       - name: Upload result to code scanning
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@v4.36.2
         with:
           sarif_file: results.sarif
           category: scorecard
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index d2c5bd4d3..71a4509b6 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -262,7 +262,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v6
 
-      - uses: docker/setup-buildx-action@v4
+      - uses: docker/setup-buildx-action@v4.1.0
 
       - name: Build ${{ matrix.service.name }} image
         env: