diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4ce9f47d..c50ed46a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,7 +16,7 @@ jobs:
             contents: write
             pull-requests: write
         steps:
-            - uses: actions/checkout@v4 # v4
+            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
             - uses: ./.github/workflows/setup
 
             - name: Update npm config
diff --git a/.github/workflows/setup/action.yml b/.github/workflows/setup/action.yml
index 49b8d52e..e15c8d56 100644
--- a/.github/workflows/setup/action.yml
+++ b/.github/workflows/setup/action.yml
@@ -14,7 +14,7 @@ inputs:
 runs:
     using: composite
     steps:
-        - uses: actions/setup-node@v4 # v4
+        - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4
           with:
               node-version: ${{ inputs.NODE_VERSION }}
 
@@ -29,7 +29,7 @@ runs:
           id: pnpm-cache
           run: 'echo "pnpm_cache_dir=$(pnpm store path)" >> $GITHUB_OUTPUT'
 
-        - uses: actions/cache@v4 # v4
+        - uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
           name: Setup pnpm cache
           with:
               path: ${{ steps.pnpm-cache.outputs.pnpm_cache_dir }}
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index d9eeeec2..4a8843a3 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -12,7 +12,7 @@ jobs:
     lint:
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@v4 # v4
+            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
             - uses: ./.github/workflows/setup
             - run: pnpm lint
 
@@ -25,16 +25,16 @@ jobs:
                 os: [macos-latest, ubuntu-latest, windows-latest]
 
         steps:
-            - uses: actions/checkout@v4 # v4
+            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
             - uses: ./.github/workflows/setup
 
-            - uses: actions/cache@v4 # v4
+            - uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
               if: ${{ !env.ACT }}
               id: relate-e2e-dbms-cache
               with:
                   path: 'e2e/relate fixtures/cache/dbmss'
                   key: relate-e2e-dbms-${{ runner.os }}
-            - uses: actions/cache@v4 # v4
+            - uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
               if: ${{ !env.ACT }}
               id: relate-e2e-runtime-cache
               with: