diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 328394cf..3df890ab 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -15,16 +15,20 @@ jobs:
     name: Build documentation
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      # 6.0.2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+
+      # 6.2.0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
         with:
-          python-version: '3.10'
           cache: 'pip'
           cache-dependency-path: '**/requirements*.txt'
+
       - name: Install dependencies
         run: |
           python3 -m pip install -U pip
           pip install -U -r requirements.txt
+
       - name: Sphinx build
         run: |
           echo "::add-matcher::.github/matchers/sphinx.json"
@@ -32,6 +36,7 @@ jobs:
           echo "::remove-matcher owner=sphinx::"
         env:
           SPHINXOPTS: -n -W -a --keep-going
+
       - name: Upload docs as artifacts
         uses: actions/upload-artifact@v4
         with:
@@ -43,21 +48,26 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request'
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      # 6.0.2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+
+      # 6.2.0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
         with:
-          python-version: '3.10'
           cache: 'pip'
           cache-dependency-path: '**/requirements*.txt'
+
       - name: Install dependencies
         run: |
           python3 -m pip install -U pip
           pip install -U -r requirements.txt
+
       - name: Sphinx linkcheck
         run: |
           make -C docs/ linkcheck SPHINXOPTS="${SPHINXOPTS}"
         env:
           SPHINXOPTS: -n -W -a --keep-going
+
       - name: Sphinx linkcheck collect
         if: always()
         run: |
@@ -66,7 +76,9 @@ jobs:
           sed 's@^@docs/@' docs/_build/linkcheck/output.txt
           echo "::remove-matcher owner=sphinx::"
           echo "::remove-matcher owner=sphinx-warn::"
-      - uses: actions/upload-artifact@v4
+
+      # 7.0.0
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
         if: always()
         with:
           name: Linkcheck report
diff --git a/.github/workflows/update-flatpak-builder-docs.yml b/.github/workflows/update-flatpak-builder-docs.yml
index 311d4ca5..8d70e24c 100644
--- a/.github/workflows/update-flatpak-builder-docs.yml
+++ b/.github/workflows/update-flatpak-builder-docs.yml
@@ -10,7 +10,9 @@ jobs:
     name: Update Flatpak Builder docs
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      # 6.0.2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+
       - name: Install dependencies
         run: |
           sudo apt install -y appstream git libxml2-utils
@@ -49,7 +51,8 @@ jobs:
 
       - name: Create pull request
         if: ${{ success() && steps.vercomp.outcome == 'success' }}
-        uses: peter-evans/create-pull-request@v7
+        # 8.1.0
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           branch-suffix: "random"
diff --git a/.github/workflows/update-flatpak-docs.yml b/.github/workflows/update-flatpak-docs.yml
index fec63909..d4b4a55b 100644
--- a/.github/workflows/update-flatpak-docs.yml
+++ b/.github/workflows/update-flatpak-docs.yml
@@ -10,7 +10,9 @@ jobs:
     name: Update Flatpak docs
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      # 6.0.2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+
       - name: Install dependencies
         run: |
           sudo apt install -y appstream git libxml2-utils
@@ -49,7 +51,8 @@ jobs:
 
       - name: Create pull request
         if: ${{ success() && steps.vercomp.outcome == 'success' }}
-        uses: peter-evans/create-pull-request@v7
+        # 8.1.0
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           branch-suffix: "random"