diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 2512be09a..41bfe32cd 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -20,7 +20,7 @@ jobs:
       - name: Set up Poetry
         uses: ni/python-actions/setup-poetry@v0.1.0
       - name: Cache virtualenv (all extras)
-        uses: actions/cache@v4
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
           path: .venv
           key: nidaqmx-all-extras-${{ runner.os }}-py${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('poetry.lock') }}
diff --git a/.github/workflows/generate_docs.yml b/.github/workflows/generate_docs.yml
index 6dce2fe7c..d20c2d00d 100644
--- a/.github/workflows/generate_docs.yml
+++ b/.github/workflows/generate_docs.yml
@@ -17,7 +17,7 @@ jobs:
       - name: Set up Poetry
         uses: ni/python-actions/setup-poetry@v0.1.0
       - name: Cache virtualenvs
-        uses: actions/cache@v4
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
           path: |
             .venv
diff --git a/.github/workflows/run_system_tests.yml b/.github/workflows/run_system_tests.yml
index 224f9dba0..15b98d75d 100644
--- a/.github/workflows/run_system_tests.yml
+++ b/.github/workflows/run_system_tests.yml
@@ -24,7 +24,7 @@ jobs:
       - name: Import DAQmx config
         run: C:\nidaqmxconfig\targets\win64U\x64\msvc-14.0\release\nidaqmxconfig.exe --eraseconfig --import tests\max_config\nidaqmxMaxConfig.ini
       - name: Cache virtualenvs
-        uses: actions/cache@v4
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
           path: |
             .venv
diff --git a/.github/workflows/run_unit_tests.yml b/.github/workflows/run_unit_tests.yml
index 0af900470..d2fbd5a49 100644
--- a/.github/workflows/run_unit_tests.yml
+++ b/.github/workflows/run_unit_tests.yml
@@ -25,7 +25,7 @@ jobs:
       - name: Set up Poetry
         uses: ni/python-actions/setup-poetry@v0.1.0
       - name: Restore cached virtualenv (main only)
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         id: restore-nidaqmx-main-only
         with:
           path: .venv
@@ -37,13 +37,13 @@ jobs:
       - name: check installdriver subcommand can be invoked
         run: poetry run nidaqmx installdriver --help
       - name: Save cached virtualenv (main only)
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         if: steps.restore-nidaqmx-main-only.outputs.cache-hit != 'true'
         with:
           path: .venv
           key: ${{ steps.restore-nidaqmx-main-only.outputs.cache-primary-key }}
       - name: Cache virtualenv (with dev dependencies)
-        uses: actions/cache@v4
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
           path: .venv
           key: nidaqmx-with-dev-${{ runner.os }}-py${{ matrix.python-version }}-${{ hashFiles('poetry.lock') }}