diff --git a/.github/workflows/auto-approve.yml b/.github/workflows/auto-approve.yml
index c6319d36c..35934d5e3 100644
--- a/.github/workflows/auto-approve.yml
+++ b/.github/workflows/auto-approve.yml
@@ -9,7 +9,7 @@ jobs:
     if: "! startsWith(github.event.head_commit.message, '[CI Skip]') && (!github.event.pull_request || github.event.pull_request.head.repo.full_name == github.repository)"
     runs-on: ubuntu-latest
     steps:
-      - uses: jacogr/action-approve@master
+      - uses: jacogr/action-approve@9d6ce78d26f23ad29d009d034822cf773f2cb50e
         with:
           authors: jacogr
           labels: -auto
diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml
index 0d4e80659..afd055c93 100644
--- a/.github/workflows/auto-merge.yml
+++ b/.github/workflows/auto-merge.yml
@@ -8,7 +8,7 @@ jobs:
   merge:
     runs-on: ubuntu-latest
     steps:
-      - uses: jacogr/action-merge@master
+      - uses: jacogr/action-merge@3b4b49af8a8644bf5cbb5409ee236abe04eeb1b0
         with:
           checks: build,lint,test
           labels: -auto
diff --git a/.github/workflows/crosscheck.yml b/.github/workflows/crosscheck.yml
index 5db7bb341..91a9f8a88 100644
--- a/.github/workflows/crosscheck.yml
+++ b/.github/workflows/crosscheck.yml
@@ -11,7 +11,7 @@ jobs:
       CI_LOG: 123
       GITHUB_TOKEN: ${{ secrets.GH_PAT_BOT }}
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@7884fcad6b5d53d10323aee724dc68d8b9096a2e
     - name: check
       run: |
         yarn install --immutable | grep -v 'YN0013'
@@ -30,7 +30,7 @@ jobs:
       CI_LOG: 123
       GITHUB_TOKEN: ${{ secrets.GH_PAT_BOT }}
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@7884fcad6b5d53d10323aee724dc68d8b9096a2e
     - name: check
       run: |
         yarn install --immutable | grep -v 'YN0013'
diff --git a/.github/workflows/lock.yml b/.github/workflows/lock.yml
index add3cf284..e25084236 100644
--- a/.github/workflows/lock.yml
+++ b/.github/workflows/lock.yml
@@ -10,7 +10,7 @@ jobs:
     env:
       YARN_ENABLE_SCRIPTS: false
     steps:
-      - uses: dessant/lock-threads@v2
+      - uses: dessant/lock-threads@f1a42f0f44eb83361d617a014663e1a76cf282d2
         with:
           github-token: ${{ secrets.GH_PAT_BOT }}
           issue-lock-inactive-days: '7'
diff --git a/.github/workflows/pr-any.yml b/.github/workflows/pr-any.yml
index 703b79ace..e234c3c7b 100644
--- a/.github/workflows/pr-any.yml
+++ b/.github/workflows/pr-any.yml
@@ -12,8 +12,8 @@ jobs:
       YARN_ENABLE_SCRIPTS: false
       CC_TEST_REPORTER_ID: ${{ secrets.CC_TEST_REPORTER_ID }}
     steps:
-    - uses: actions/checkout@v2
-    - uses: denoland/setup-deno@v1
+    - uses: actions/checkout@7884fcad6b5d53d10323aee724dc68d8b9096a2e
+    - uses: denoland/setup-deno@004814556e37c54a2f6e31384c9e18e983317366
       with:
         deno-version: vx.x.x
     - name: ${{ matrix.step }}
diff --git a/.github/workflows/push-master.yml b/.github/workflows/push-master.yml
index acda1cd8e..cff8e5820 100644
--- a/.github/workflows/push-master.yml
+++ b/.github/workflows/push-master.yml
@@ -19,7 +19,7 @@ jobs:
       GH_RELEASE_GITHUB_API_TOKEN: ${{ secrets.GH_PAT }}
       NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@7884fcad6b5d53d10323aee724dc68d8b9096a2e
       with:
         fetch-depth: 0
         token: ${{ secrets.GH_PAT }}
@@ -42,7 +42,7 @@ jobs:
       PINATA_API_KEY: ${{ secrets.PINATA_API_KEY }}
       PINATA_SECRET_KEY: ${{ secrets.PINATA_SECRET_KEY }}
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@7884fcad6b5d53d10323aee724dc68d8b9096a2e
     - name: ${{ matrix.step }}
       run: |
         yarn install --immutable | grep -v 'YN0013'
diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index d2339ac33..52b4c7f6c 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -12,8 +12,8 @@ jobs:
     env:
       YARN_ENABLE_SCRIPTS: false
     steps:
-      - uses: actions/checkout@v2
-      - uses: returntocorp/semgrep-action@v1
+      - uses: actions/checkout@7884fcad6b5d53d10323aee724dc68d8b9096a2e
+      - uses: returntocorp/semgrep-action@aeafd770072c4f48798b991e3449592bddc2c435
         with:
           auditOn: push
           publishToken: ${{ secrets.SEMGREP_APP_TOKEN }}
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 68c1f828f..4ab906783 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -9,7 +9,7 @@ jobs:
     env:
       YARN_ENABLE_SCRIPTS: false
     steps:
-      - uses: actions/stale@v3
+      - uses: actions/stale@98ed4cb500039dbcccf4bd9bedada4d0187f2757
         with:
           repo-token: ${{ secrets.GH_PAT_BOT }}
           stale-issue-message: 'This issue has been open for 21 days with no activity and is not labelled as an enhancement. It will be closed in 7 days.'