diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index dfb56ab2c..a0a2ac7e7 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -10,11 +10,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: 3.x
       - name: Install Dependencies
diff --git a/.github/workflows/no-merge-commits.yml b/.github/workflows/no-merge-commits.yml
index 3e1f59a8e..d9392ef54 100644
--- a/.github/workflows/no-merge-commits.yml
+++ b/.github/workflows/no-merge-commits.yml
@@ -16,9 +16,9 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Run test
-        uses: NexusPHP/no-merge-commits@v2.4.1
+        uses: NexusPHP/no-merge-commits@109a3342781ddcf26b2fa739f29e8ee9f68b7d8e # v2.4.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/phpunit-lang.yml b/.github/workflows/phpunit-lang.yml
index 055d4b0eb..bf6cebcd4 100644
--- a/.github/workflows/phpunit-lang.yml
+++ b/.github/workflows/phpunit-lang.yml
@@ -28,10 +28,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Set up PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # v2.37.1
         with:
           php-version: '8.1'
           tools: composer, phive, phpunit
diff --git a/.github/workflows/smart-commenting.yml b/.github/workflows/smart-commenting.yml
index 80a1fb204..3361c9f72 100644
--- a/.github/workflows/smart-commenting.yml
+++ b/.github/workflows/smart-commenting.yml
@@ -12,7 +12,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Add comment for GPG-sign
-        uses: peter-evans/create-or-update-comment@v5
+        uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
         with:
           issue-number: ${{ github.event.pull_request.number }}
           body: |
@@ -31,7 +31,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Add comment for PHPUnit test
-        uses: peter-evans/create-or-update-comment@v5
+        uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
         with:
           issue-number: ${{ github.event.pull_request.number }}
           body: |
@@ -51,7 +51,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Add comment for resolving a merge conflict
-        uses: peter-evans/create-or-update-comment@v5
+        uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
         with:
           issue-number: ${{ github.event.pull_request.number }}
           body: |