diff --git a/.github/workflows/cli-pr-checks.yml b/.github/workflows/cli-pr-checks.yml
index f63de681..849eacb2 100644
--- a/.github/workflows/cli-pr-checks.yml
+++ b/.github/workflows/cli-pr-checks.yml
@@ -12,10 +12,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '22'
           cache: 'npm'
diff --git a/.github/workflows/conventional-commit-check-commits.yml b/.github/workflows/conventional-commit-check-commits.yml
index 11b58acc..bc608754 100644
--- a/.github/workflows/conventional-commit-check-commits.yml
+++ b/.github/workflows/conventional-commit-check-commits.yml
@@ -7,6 +7,6 @@ jobs:
   check-conventional-commits:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Check Commit Conventions
-        uses: webiny/action-conventional-commits@v1.3.0
+        uses: webiny/action-conventional-commits@8bc41ff4e7d423d56fa4905f6ff79209a78776c7 # v1.3.0
diff --git a/.github/workflows/conventional-commit-check-pr-title.yml b/.github/workflows/conventional-commit-check-pr-title.yml
index 28a18f2a..64a0598a 100644
--- a/.github/workflows/conventional-commit-check-pr-title.yml
+++ b/.github/workflows/conventional-commit-check-pr-title.yml
@@ -12,4 +12,4 @@ jobs:
   lint-pr-title:
     permissions:
       pull-requests: read
-    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/conventional-commits.yml@conventional-commits-v1.1.0
+    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/conventional-commits.yml@7825b11bd6f0b141075368add5223c873d76a2d3 # conventional-commits-v1.2.1
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 183dfd79..bde68ba5 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -13,5 +13,5 @@ permissions:
 
 jobs:
   release-please:
-    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/release-please.yml@release-please-v2.1.0
+    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/release-please.yml@1c4f92368b01037ca4f209c2f9179cf8a07f00ff # release-please-v2.2.1
     secrets: inherit
diff --git a/.github/workflows/reusable-cli-npm.yml b/.github/workflows/reusable-cli-npm.yml
index 8e9d339a..c33d3cf5 100644
--- a/.github/workflows/reusable-cli-npm.yml
+++ b/.github/workflows/reusable-cli-npm.yml
@@ -20,7 +20,7 @@ on:
 
 jobs:
   npm-publish:
-    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/publish-npm.yml@publish-npm-v1.6.0
+    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/publish-npm.yml@1f9f07ab7380426fd6b59c32baa352a89e8a479b # publish-npm-v1.7.1
     with:
       working-directory: cli
       install-command: npm ci
diff --git a/.github/workflows/reusable-compute-staging-version.yml b/.github/workflows/reusable-compute-staging-version.yml
index 740cecc7..3c3c6468 100644
--- a/.github/workflows/reusable-compute-staging-version.yml
+++ b/.github/workflows/reusable-compute-staging-version.yml
@@ -19,9 +19,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '20'
       - name: Set publish version