diff --git a/.github/workflows/build-publish-cli.yml b/.github/workflows/build-publish-cli.yml
index 2085a17..0fdc18e 100644
--- a/.github/workflows/build-publish-cli.yml
+++ b/.github/workflows/build-publish-cli.yml
@@ -89,7 +89,7 @@ jobs:
           merge-multiple: true
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65  # v2
         with:
           tag_name: ${{ steps.get_version.outputs.version }}
           name: Release ${{ steps.get_version.outputs.version }}
diff --git a/.github/workflows/docker-build-push-ai.yml b/.github/workflows/docker-build-push-ai.yml
index 892c3c7..da1becf 100644
--- a/.github/workflows/docker-build-push-ai.yml
+++ b/.github/workflows/docker-build-push-ai.yml
@@ -32,12 +32,12 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f  # v3
         with:
           install: true
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9  # v3
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
@@ -74,7 +74,7 @@ jobs:
           echo "DOCKER_HUB_USERNAME=${{ secrets.DOCKER_HUB_USERNAME }}" >> $GITHUB_ENV
 
       - name: Build and push ai
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25  # v5
         with:
           context: ./package/ai
           file: ./package/ai/${{ matrix.dockerfile }}
diff --git a/.github/workflows/docker-build-push-frontend.yml b/.github/workflows/docker-build-push-frontend.yml
index 955ba8e..ad5f670 100644
--- a/.github/workflows/docker-build-push-frontend.yml
+++ b/.github/workflows/docker-build-push-frontend.yml
@@ -17,12 +17,12 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f  # v3
         with:
           install: true
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9  # v3
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
@@ -49,7 +49,7 @@ jobs:
           echo "DOCKER_HUB_USERNAME=${{ secrets.DOCKER_HUB_USERNAME }}" >> $GITHUB_ENV
 
       - name: Build and push frontend
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25  # v5
         with:
           context: ./package/website
           platforms: linux/amd64,linux/arm64
diff --git a/.github/workflows/docker-build-push-server.yml b/.github/workflows/docker-build-push-server.yml
index 85fd2a7..17c88a0 100644
--- a/.github/workflows/docker-build-push-server.yml
+++ b/.github/workflows/docker-build-push-server.yml
@@ -17,12 +17,12 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f  # v3
         with:
           install: true
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9  # v3
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
@@ -49,7 +49,7 @@ jobs:
           echo "DOCKER_HUB_USERNAME=${{ secrets.DOCKER_HUB_USERNAME }}" >> $GITHUB_ENV
 
       - name: Build and push server
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25  # v5
         with:
           context: ./package/server
           platforms: linux/amd64,linux/arm64
diff --git a/.github/workflows/e2e-system-tests.yml b/.github/workflows/e2e-system-tests.yml
index 677d9b9..695f251 100644
--- a/.github/workflows/e2e-system-tests.yml
+++ b/.github/workflows/e2e-system-tests.yml
@@ -23,7 +23,7 @@ jobs:
         node-version: '20'
 
     - name: Install pnpm
-      uses: pnpm/action-setup@v3
+      uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d  # v3
       with:
         version: 9
         run_install: false