diff --git a/.github/workflows/build-rpm.yaml b/.github/workflows/build-rpm.yaml
index 0dff760..f52dad4 100644
--- a/.github/workflows/build-rpm.yaml
+++ b/.github/workflows/build-rpm.yaml
@@ -29,7 +29,7 @@ jobs:
         run: |
           echo "%_topdir $(pwd)/rpmbuild" >> ~/.rpmmacros
           rpmdev-setuptree
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           path: 'rpmbuild/BUILD'
           fetch-depth: 0
@@ -95,7 +95,7 @@ jobs:
             exit 0
           fi
           GPG_TTY="" rpm --addsign rpmbuild/RPMS/noarch/*.rpm
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: build-rpm-${{ matrix.os }}-${{ matrix.version }}
           path: |
@@ -117,8 +117,8 @@ jobs:
     if: needs.build-rpm.outputs.repo == 'stable'
     steps:
       - name: Check out repository code
-        uses: actions/checkout@v6
-      - uses: actions/download-artifact@v8
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       - name: Create release
         run: |
           # Get from the changelog file only the part related to the tagged release, in particular:
diff --git a/.github/workflows/maven.yaml b/.github/workflows/maven.yaml
index 585158b..96322af 100644
--- a/.github/workflows/maven.yaml
+++ b/.github/workflows/maven.yaml
@@ -11,9 +11,9 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
     - name: Set up JDK 17
-      uses: actions/setup-java@v5
+      uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
       with:
         distribution: 'temurin'
         java-version: 17
@@ -49,7 +49,7 @@ jobs:
         cd ../../../
 
     - name: Cache Maven packages
-      uses: actions/cache@v5
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
         path: ~/.m2
         key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
diff --git a/.github/workflows/reuse.yaml b/.github/workflows/reuse.yaml
index 846c7ff..db789d9 100644
--- a/.github/workflows/reuse.yaml
+++ b/.github/workflows/reuse.yaml
@@ -8,6 +8,6 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: REUSE Compliance Check
-        uses: fsfe/reuse-action@v6
+        uses: fsfe/reuse-action@676e2d560c9a403aa252096d99fcab3e1132b0f5 # v6.0.0