diff --git a/.github/workflows/bloat.yml b/.github/workflows/bloat.yml
index 9f20bbdbf5a6..0562a98a1f64 100644
--- a/.github/workflows/bloat.yml
+++ b/.github/workflows/bloat.yml
@@ -59,7 +59,7 @@ jobs:
       - run: sudo bash ./ci/prepare_build_environment.sh
 
       - name: Run cargo bloat
-        uses: wsxiaoys/cargo-bloat-action@master
+        uses: wsxiaoys/cargo-bloat-action@8be354bd62ad6d986bae0bee4f3a6db31dfa3033 # master
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           include_packages: tabby
\ No newline at end of file
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index f2af4232d353..7e1652b7eba0 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -40,7 +40,7 @@ jobs:
 
     steps:
       - name: Free Disk Space (Ubuntu)
-        uses: jlumbroso/free-disk-space@main
+        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # main
         with:
           # this might remove tools that are actually needed,
           # if set to "true" but frees about 6 GB
diff --git a/.github/workflows/gpt-translate.yml b/.github/workflows/gpt-translate.yml
index f692d5d16d23..960d6b862e33 100644
--- a/.github/workflows/gpt-translate.yml
+++ b/.github/workflows/gpt-translate.yml
@@ -20,6 +20,6 @@ jobs:
         if: |
           contains(github.event.comment.body, '/gpt-translate') || 
           contains(github.event.comment.body, '/gt')
-        uses: 3ru/gpt-translate@master
+        uses: 3ru/gpt-translate@d36d569b15411b6e6f727b99c051c443b1b02458 # master
         with:
           apikey: ${{ secrets.OPENAI_API_KEY }}
diff --git a/.github/workflows/release-vim.yml b/.github/workflows/release-vim.yml
index 35933a0a0cbd..e104e2e1c68a 100644
--- a/.github/workflows/release-vim.yml
+++ b/.github/workflows/release-vim.yml
@@ -41,7 +41,7 @@ jobs:
         git commit -m "release: vim-tabby version ${{ steps.get_version.outputs.version }}"
         git tag ${{ steps.get_version.outputs.version }}
     - name: Push changes
-      uses: ad-m/github-push-action@master
+      uses: ad-m/github-push-action@881a6320fdb16eb5318c5054f31c218aec2b324c # master
       with:
         repository: TabbyML/vim-tabby
         github_token: ${{ secrets.VIM_RELEASE_GH_TOKEN }}