diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4727801..709b90f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -35,11 +35,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
       - name: Setup Release
         id: setup_release
-        uses: LizardByte/actions/actions/release_setup@v2026.212.22356
+        uses: LizardByte/actions/actions/release_setup@9bf3ef783775e17fe6b8dde3585d94ec570b93c2  # v2026.212.22356
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
 
@@ -113,7 +113,7 @@ jobs:
       CARGO_TERM_COLOR: always
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
       - name: Setup cross compiling (Debian)
         id: cross_compile
@@ -277,7 +277,7 @@ jobs:
           echo "::endgroup::"
 
       - name: Setup Rust
-        uses: actions-rust-lang/setup-rust-toolchain@v1.15.2
+        uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c  # v1.15.2
         with:
           target: ${{ matrix.target }}
           components: 'clippy'
@@ -317,7 +317,7 @@ jobs:
           always() &&
           (steps.test.outcome == 'success' || steps.test.outcome == 'failure') &&
           startsWith(github.repository, 'LizardByte/')
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de  # v5.5.2
         with:
           disable_search: true
           fail_ci_if_error: true
@@ -360,7 +360,7 @@ jobs:
             "./target/${{ matrix.target }}/release/koko${extension}"
 
       - name: Upload Artifacts
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
         with:
           if-no-files-found: 'error'
           name: koko-${{ matrix.target }}
@@ -369,7 +369,7 @@ jobs:
       - name: Create/Update GitHub Release
         if: false  # TODO: move release to separate job
         # if: ${{ needs.setup_release.outputs.publish_release == 'true' }}
-        uses: LizardByte/actions/actions/release_create@v2026.212.22356
+        uses: LizardByte/actions/actions/release_create@9bf3ef783775e17fe6b8dde3585d94ec570b93c2  # v2026.212.22356
         with:
           allowUpdates: true
           body: ${{ needs.setup_release.outputs.release_body }}