diff --git a/.github/workflows/python.yml b/.github/workflows/python.yml
index a711170..139f871 100644
--- a/.github/workflows/python.yml
+++ b/.github/workflows/python.yml
@@ -122,7 +122,7 @@ jobs:
         #   output-dir: wheelhouse
         #   config-file: "{package}/pyproject.toml"
 
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: cibw-wheels-${{ matrix.os }}-${{ strategy.job-index }}
           path: ./wheelhouse/*.whl
@@ -139,7 +139,7 @@ jobs:
         run: pipx run build --sdist
         working-directory: py
 
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: cibw-sdist
           path: dist/*.tar.gz
@@ -154,7 +154,7 @@ jobs:
     # or, alternatively, upload to PyPI on every tag starting with 'v' (remove on: release above to use this)
     if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
     steps:
-      - uses: actions/download-artifact@v7
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           # unpacks all CIBW artifacts into dist/
           pattern: cibw-*
@@ -180,7 +180,7 @@ jobs:
     # or, alternatively, upload to PyPI on every tag starting with 'v' (remove on: release above to use this)
     # if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
     steps:
-      - uses: actions/download-artifact@v7
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           # unpacks all CIBW artifacts into dist/
           pattern: cibw-*
diff --git a/.github/workflows/wasm-build-deploy.yml b/.github/workflows/wasm-build-deploy.yml
index 9850257..6a7f91a 100644
--- a/.github/workflows/wasm-build-deploy.yml
+++ b/.github/workflows/wasm-build-deploy.yml
@@ -36,7 +36,7 @@ jobs:
           cp -r pkg build/pkg
 
       - name: Upload build artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: wasm-build
           path: js/build
@@ -54,7 +54,7 @@ jobs:
 
     steps:
       - name: Download build artifact
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: wasm-build
           path: dist