diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 6e48900..adb1e3a 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -9,18 +9,18 @@ jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: 3.x
 
-      - uses: opentofu/setup-opentofu@v2
+      - uses: opentofu/setup-opentofu@847eaa4afeb791b06daa46e8eafa8b1b68d7cfb4 # v2
         with:
           tofu_version: v1.11.7 # renovate: datasource=github-releases depName=opentofu/opentofu
           tofu_wrapper: false
 
-      - uses: pre-commit/action@v3.0.1
+      - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
         with:
           extra_args: --all-files
diff --git a/.github/workflows/releaser-pleaser.yml b/.github/workflows/releaser-pleaser.yml
index 3d77604..1cad1f9 100644
--- a/.github/workflows/releaser-pleaser.yml
+++ b/.github/workflows/releaser-pleaser.yml
@@ -24,7 +24,7 @@ jobs:
       pull-requests: write
     steps:
       - name: releaser-pleaser
-        uses: apricote/releaser-pleaser@v0.8.0
+        uses: apricote/releaser-pleaser@a1ce9493fd3f3abe60f22c37249d257bc10081dc # v0.8.0
         with:
           token: ${{ secrets.HCLOUD_BOT_TOKEN }}
           extra-files: |
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 488b15d..73adc42 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -21,14 +21,14 @@ jobs:
         working-directory: example
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
-      - uses: opentofu/setup-opentofu@v2
+      - uses: opentofu/setup-opentofu@847eaa4afeb791b06daa46e8eafa8b1b68d7cfb4 # v2
         with:
           tofu_version: v1.11.7 # renovate: datasource=github-releases depName=opentofu/opentofu
           tofu_wrapper: false
 
-      - uses: hashicorp/setup-nomad@main
+      - uses: hashicorp/setup-nomad@daef63d2965093b49089f7ad2ce4d97475817b3d # main
         id: setup
         with:
           version: 2.0.1 # renovate: datasource=github-releases depName=hashicorp/nomad
@@ -41,7 +41,7 @@ jobs:
         env:
           CONSUL_VERSION: 1.22.7 # renovate: datasource=github-releases depName=hashicorp/consul extractVersion=v(?<version>.+)
 
-      - uses: hetznercloud/tps-action@main
+      - uses: hetznercloud/tps-action@dc6d67c5768ca43b840429b6c7409cda61cf4092 # main
 
       - name: Swap module source
         run: sed -i -e 's|source = ".*"|source = "./.."|' main.tf