diff --git a/.github/workflows/codspeed.yml b/.github/workflows/codspeed.yml
index ce80c56..72a8dfe 100644
--- a/.github/workflows/codspeed.yml
+++ b/.github/workflows/codspeed.yml
@@ -30,10 +30,12 @@ jobs:
       id-token: write
     steps:
       - name: Check out repository
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v10.1.0
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           enable-cache: true
           # Same minor as the devcontainer's CPython (.devcontainer/Dockerfile's
@@ -45,7 +47,7 @@ jobs:
         run: uv sync --locked --all-groups
 
       - name: Run benchmarks
-        uses: CodSpeedHQ/action@v5.5.0
+        uses: CodSpeedHQ/action@821a40cd6c80e3cfe387caf55668287addd808da # v5.5.0
         with:
           mode: simulation
           # pyproject.toml's cache_dir points into the devcontainer's home, which