diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 09c4e14..ed50412 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,10 +14,10 @@ jobs:
         runtime: [bun, node]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           # LOAD-BEARING for `Verify generated artifacts`, not just a test-runtime choice.
           # That step rebuilds bin/ and dist/ and compares the result BYTE-FOR-BYTE against
@@ -34,7 +34,7 @@ jobs:
 
       - name: Setup Node
         if: matrix.runtime == 'node'
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: latest
 
@@ -54,8 +54,8 @@ jobs:
         runtime: [bun]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: oven-sh/setup-bun@v2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           # Must match the `test` job above — see the note there on why this version is
           # load-bearing for the generated-artifact byte comparison.