diff --git a/build-poetry/action.yml b/build-poetry/action.yml
index 60dada5f..257e72de 100644
--- a/build-poetry/action.yml
+++ b/build-poetry/action.yml
@@ -107,7 +107,7 @@ runs:
       with:
         host-actions-root: ${{ steps.set-path.outputs.host_actions_root }}
     - name: Cache local Poetry cache
-      uses: SonarSource/gh-action_cache@v1.2.3
+      uses: SonarSource/gh-action_cache@957cb1f6f70956976b834546bf09839080b5bb00 # v1.2.3
       if: inputs.disable-caching == 'false'
       with:
         path: ${{ github.workspace }}/${{ inputs.poetry-cache-dir }}
diff --git a/build-yarn/action.yml b/build-yarn/action.yml
index 9ce1b129..f96a395c 100644
--- a/build-yarn/action.yml
+++ b/build-yarn/action.yml
@@ -111,7 +111,7 @@ runs:
         working_directory: ${{ inputs.working-directory }}
 
     - name: Cache Yarn dependencies
-      uses: SonarSource/gh-action_cache@v1.2.3
+      uses: SonarSource/gh-action_cache@957cb1f6f70956976b834546bf09839080b5bb00 # v1.2.3
       if: ${{ inputs.cache-yarn == 'true' }}
       with:
         path: |
diff --git a/cache/action.yml b/cache/action.yml
index c11fff2b..d9ebc028 100644
--- a/cache/action.yml
+++ b/cache/action.yml
@@ -36,7 +36,7 @@ runs:
         echo "::warning:: This action is deprecated and will be removed in future releases. " \
           "Please migrate to using the SonarSource/gh-action_cache action directly." >&2
 
-    - uses: SonarSource/gh-action_cache@v1.2.3
+    - uses: SonarSource/gh-action_cache@957cb1f6f70956976b834546bf09839080b5bb00 # v1.2.3
       id: cache
       with:
         path: ${{ inputs.path }}
diff --git a/code-signing/action.yml b/code-signing/action.yml
index c20d8f4b..14e9e843 100644
--- a/code-signing/action.yml
+++ b/code-signing/action.yml
@@ -22,7 +22,7 @@ runs:
         echo "JSIGN_CACHE_PATH=/tmp/jsign-cache" >> "$GITHUB_ENV"
 
     - name: Cache code signing tools
-      uses: SonarSource/gh-action_cache@v1.2.3
+      uses: SonarSource/gh-action_cache@957cb1f6f70956976b834546bf09839080b5bb00 # v1.2.3
       id: tools-cache
       with:
         path: |
diff --git a/config-gradle/action.yml b/config-gradle/action.yml
index f0db6b48..105253ca 100644
--- a/config-gradle/action.yml
+++ b/config-gradle/action.yml
@@ -167,7 +167,7 @@ runs:
       run: echo "workflow_name=${WORKFLOW_NAME// /-}" >> "$GITHUB_OUTPUT"
 
     - name: Gradle Cache
-      uses: SonarSource/gh-action_cache@v1.2.3
+      uses: SonarSource/gh-action_cache@957cb1f6f70956976b834546bf09839080b5bb00 # v1.2.3
       if: steps.config-gradle-completed.outputs.skip != 'true' && inputs.disable-caching == 'false'
       with:
         path: ${{ inputs.cache-paths }}
diff --git a/config-maven/action.yml b/config-maven/action.yml
index 9a1755b6..23eac665 100644
--- a/config-maven/action.yml
+++ b/config-maven/action.yml
@@ -178,7 +178,7 @@ runs:
       run: echo "workflow_name=${WORKFLOW_NAME// /-}" >> "$GITHUB_OUTPUT"
 
     - name: Cache local Maven repository
-      uses: SonarSource/gh-action_cache@v1.2.3
+      uses: SonarSource/gh-action_cache@957cb1f6f70956976b834546bf09839080b5bb00 # v1.2.3
       if: steps.config-maven-completed.outputs.skip != 'true' && inputs.disable-caching == 'false'
       with:
         path: ${{ inputs.cache-paths }}
diff --git a/config-npm/action.yml b/config-npm/action.yml
index a09b3597..ea58aab3 100644
--- a/config-npm/action.yml
+++ b/config-npm/action.yml
@@ -106,7 +106,7 @@ runs:
       run: echo "workflow_name=${WORKFLOW_NAME// /-}" >> "$GITHUB_OUTPUT"
 
     - name: Cache NPM dependencies
-      uses: SonarSource/gh-action_cache@v1.2.3
+      uses: SonarSource/gh-action_cache@957cb1f6f70956976b834546bf09839080b5bb00 # v1.2.3
       if: ${{ inputs.cache-npm == 'true' }}
       with:
         path: ~/.npm
diff --git a/config-pip/action.yml b/config-pip/action.yml
index 8534ff11..a474ca04 100644
--- a/config-pip/action.yml
+++ b/config-pip/action.yml
@@ -100,7 +100,7 @@ runs:
       run: echo "workflow_name=${WORKFLOW_NAME// /-}" >> "$GITHUB_OUTPUT"
 
     - name: Cache pip dependencies
-      uses: SonarSource/gh-action_cache@v1.2.3
+      uses: SonarSource/gh-action_cache@957cb1f6f70956976b834546bf09839080b5bb00 # v1.2.3
       if: inputs.disable-caching == 'false'
       with:
         path: ${{ inputs.cache-paths }}