diff --git a/.github/workflows/CI.yaml b/.github/workflows/CI.yaml
index 36a39c7..cacbc79 100644
--- a/.github/workflows/CI.yaml
+++ b/.github/workflows/CI.yaml
@@ -14,7 +14,7 @@ jobs:
         pixi-env: ["py39", "py310", "py311", "py312"]
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
       - name: Set up pixi
         uses: prefix-dev/setup-pixi@v0.8.1
       - name: Run tests
@@ -23,7 +23,7 @@ jobs:
   precommit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
       - name: Set up pixi
         uses: prefix-dev/setup-pixi@v0.8.1
       - name: Run prek
diff --git a/.github/workflows/prek-update.yml b/.github/workflows/prek-update.yml
index d3173d5..ec4b2aa 100644
--- a/.github/workflows/prek-update.yml
+++ b/.github/workflows/prek-update.yml
@@ -9,13 +9,13 @@ jobs:
   prek-update:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
       - name: Set up pixi
         uses: prefix-dev/setup-pixi@v0.8.1
       - name: Run prek update
         run: pixi run -e lint prek update
       - name: Create pull request
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8
         with:
           commit-message: "chore: prek update"
           title: "chore: update pre-commit hooks"
diff --git a/.github/workflows/publish-to-pypi.yml b/.github/workflows/publish-to-pypi.yml
index 92ae977..5eb5c41 100644
--- a/.github/workflows/publish-to-pypi.yml
+++ b/.github/workflows/publish-to-pypi.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
     - name: Set up Python
       uses: actions/setup-python@v6
       with: