diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index b83f2c3..71cd345 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -11,9 +11,9 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3
       - id: cache-node
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: conventional_commit_config/node_modules
           key:
diff --git a/checkout/action.yml b/checkout/action.yml
index 2c1115e..e91e476 100644
--- a/checkout/action.yml
+++ b/checkout/action.yml
@@ -74,7 +74,7 @@ runs:
   using: "composite"
   steps:
     - if: ${{ github.event_name == 'pull_request' }}
-      uses: actions/checkout@v2
+      uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2
       with:
         repository: ${{ inputs.repository }}
         ref: ${{ github.event.pull_request.head.sha }}
@@ -89,7 +89,7 @@ runs:
         lfs: ${{ inputs.lfs }}
         submodules: ${{ inputs.submodules }}
     - if: ${{ github.event_name != 'pull_request' }}
-      uses: actions/checkout@v2
+      uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2
       with:
         repository: ${{ inputs.repository }}
         ref: ${{ inputs.ref }}
@@ -104,4 +104,3 @@ runs:
         lfs: ${{ inputs.lfs }}
         submodules: ${{ inputs.submodules }}
 
-
diff --git a/newsletter/action.yml b/newsletter/action.yml
index 7568e54..b953841 100644
--- a/newsletter/action.yml
+++ b/newsletter/action.yml
@@ -22,7 +22,7 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - uses: ory/ci/checkout@master
+    - uses: ory/ci/checkout@53206fb2760d6580b0e3fa4e4d7547f5d7a0c109 # master
     - run: |
         git fetch origin +refs/tags/*:refs/tags/*
       shell: bash
@@ -44,7 +44,7 @@ runs:
         SSH_AUTH_SOCK: /tmp/ssh_agent.sock
       run: |
         git fetch origin +refs/tags/*:refs/tags/*
-        bash <(curl https://raw.githubusercontent.com/ory/meta/master/install.sh) -b . ory 
+        bash <(curl https://raw.githubusercontent.com/ory/meta/fe7e8f7035692eca99f919f7a99e103fc03f29eb/install.sh) -b . ory
         if [[ "${{ inputs.draft }}" == "false" ]]; then
           # production run
           ./ory dev release notify send "${MAILCHIMP_LIST_ID}"
diff --git a/newsletter/slack-notify/action.yml b/newsletter/slack-notify/action.yml
index 791c38f..98c3d3b 100644
--- a/newsletter/slack-notify/action.yml
+++ b/newsletter/slack-notify/action.yml
@@ -8,7 +8,7 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - uses: slackapi/slack-github-action@v1.16.0
+    - uses: slackapi/slack-github-action@410ae57cff5c6b682b106440be0e6c7eb8c98c9d # v1.16.0
       with:
         payload: |
           {
@@ -35,4 +35,3 @@ runs:
       env:
         SLACK_WEBHOOK_URL: ${{ inputs.slack-webhook-url }}
         SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
-
diff --git a/releaser/action.yml b/releaser/action.yml
index 41a3156..b3cf36e 100644
--- a/releaser/action.yml
+++ b/releaser/action.yml
@@ -22,7 +22,7 @@ runs:
   using: "composite"
   steps:
     - name: Free Disk Space (Ubuntu)
-      uses: jlumbroso/free-disk-space@main
+      uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # main
       with:
         # this might remove tools that are actually needed,
         # if set to "true" but frees about 6 GB
@@ -36,14 +36,14 @@ runs:
         large-packages: true
         docker-images: true
         swap-storage: true
-    - uses: ory/ci/checkout@master
+    - uses: ory/ci/checkout@53206fb2760d6580b0e3fa4e4d7547f5d7a0c109 # master
       with:
         token: ${{ inputs.token }}
         fetch-depth: 0
-    - uses: actions/setup-node@v6
+    - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
       with:
         node-version: "16"
-    - uses: actions/setup-go@v6
+    - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
       with:
         go-version: "1.25"
     - run: |
@@ -66,9 +66,10 @@ runs:
       shell: bash
       run: |
         sudo apt install -y moreutils
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
       with:
         repository: ory/changelog
+        ref: a084a3aeb57e581ad46f61f14f03889ece64d2f8 # master
         path: changelog
         token: ${{ inputs.token }}
 
@@ -98,8 +99,8 @@ runs:
         git reset --hard HEAD
       shell: bash
 
-    - uses: docker/setup-qemu-action@v3
-    - uses: docker/setup-buildx-action@v3
+    - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
+    - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
     - env:
         GORELEASER_CURRENT_TAG: ${{ github.ref_name }}
         GORELEASER_KEY: ${{ inputs.goreleaser_key }}
@@ -112,7 +113,7 @@ runs:
         # clean up ory/changelog checkout
         rm -rf changelog
 
-        docker pull --platform linux/amd64 oryd/xgoreleaser:latest
+        docker pull --platform linux/amd64 oryd/xgoreleaser:1.26.0-2.14.1@sha256:635fdea1104f933c13298228601ceeda725eb7ce3ed3c1757aae712f44bdd773
         docker run --privileged --mount type=bind,source="$(pwd)",target=/project \
             --mount type=bind,source="$notes",target=/notes.md \
             --platform linux/amd64 \
@@ -123,7 +124,7 @@ runs:
             -e DOCKER_PASSWORD \
             -e GORELEASER_CURRENT_TAG \
             -v /var/run/docker.sock:/var/run/docker.sock \
-            oryd/xgoreleaser:latest release --release-header "/notes.md" --clean --timeout 60m
+            oryd/xgoreleaser:1.26.0-2.14.1@sha256:635fdea1104f933c13298228601ceeda725eb7ce3ed3c1757aae712f44bdd773 release --release-header "/notes.md" --clean --timeout 60m
 
         git add -A
         git stash || true