diff --git a/.github/workflows/renovate_release.yml b/.github/workflows/renovate_release.yml
index bae0aee..98a4c73 100644
--- a/.github/workflows/renovate_release.yml
+++ b/.github/workflows/renovate_release.yml
@@ -6,6 +6,6 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: infrabits/ci-create-renovate-release@main
+      - uses: infrabits/ci-create-renovate-release@690d3582120fdb652786680c820a26aa006b1650 # main
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/tag_release.yml b/.github/workflows/tag_release.yml
index fd34a28..72e5115 100644
--- a/.github/workflows/tag_release.yml
+++ b/.github/workflows/tag_release.yml
@@ -7,7 +7,7 @@ jobs:
       contents: write
     steps:
       - name: Create GitHub release
-        uses: infrabits/ci-create-missing-release@main
+        uses: infrabits/ci-create-missing-release@9b9b256bbdf59a093f847f2d7fa18700eaadffa1 # main
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           tag: '${{ github.ref }}'
diff --git a/action.yml b/action.yml
index bd42c3e..af33cda 100644
--- a/action.yml
+++ b/action.yml
@@ -51,7 +51,7 @@ runs:
         echo "access_token=$(echo "${access_token}" | jq -r .token)" >> $GITHUB_OUTPUT
 
     - name: Clone component-configs repo
-      uses: actions/checkout@v6
+      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       with:
         repository: cluebotng/component-configs
         ref: main