diff --git a/.github/workflows/cla.yaml b/.github/workflows/cla.yaml
index 30b7942..f46b3f5 100644
--- a/.github/workflows/cla.yaml
+++ b/.github/workflows/cla.yaml
@@ -20,7 +20,7 @@ jobs:
           (github.event.comment.body == 'recheck'
             || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA')
             || github.event_name == 'pull_request_target'
-        uses: contributor-assistant/github-action@v2.4.0
+        uses: contributor-assistant/github-action@9340315624c6e16cef1f2c63bdeb0f0c49c6f474 # v2.4.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PERSONAL_ACCESS_TOKEN: ${{ secrets.REPO_GITHUB_TOKEN }}
diff --git a/.github/workflows/propagate.yml b/.github/workflows/propagate.yml
index d1f30c3..4b3dab4 100644
--- a/.github/workflows/propagate.yml
+++ b/.github/workflows/propagate.yml
@@ -109,12 +109,12 @@ jobs:
           echo "reviewers=${reviewers_input:-$DEFAULT_REVIEWERS}" >> $GITHUB_ENV
 
       - name: Checkout this repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           path: ./origin-repo
 
       - name: Checkout ${{ matrix.repos.name }} repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           repository: ${{ github.repository_owner }}/${{ matrix.repos.name }}
           path: ./destination-repo
@@ -149,7 +149,7 @@ jobs:
           done
 
       - name: Commit and push changes
-        uses: stefanzweifel/git-auto-commit-action@v5
+        uses: stefanzweifel/git-auto-commit-action@b863ae1933cb653a53c021fe36dbb774e1fb9403 # v5
         with:
           commit_message: '[skip ci] Propagate files from ${{ github.repository }}'
           file_pattern: ${{ matrix.repos.files-to-propagate }}
@@ -164,7 +164,7 @@ jobs:
         shell: bash
 
       - name: Create and merge PR in ${{ matrix.repos.name }} repository
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           github-token: ${{ secrets.REPO_GITHUB_TOKEN }}
           script: |