diff --git a/.github/workflows/check_misc.yml b/.github/workflows/check_misc.yml
index 543c54a3c9c679..7c7433ae1cc0d1 100644
--- a/.github/workflows/check_misc.yml
+++ b/.github/workflows/check_misc.yml
@@ -78,7 +78,7 @@ jobs:
           }}
 
       - name: Upload docs
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           path: html
           name: ${{ steps.docs.outputs.htmlout }}
diff --git a/.github/workflows/cygwin.yml b/.github/workflows/cygwin.yml
index d822a2e9e217e3..c6a6dc95ebfd10 100644
--- a/.github/workflows/cygwin.yml
+++ b/.github/workflows/cygwin.yml
@@ -45,7 +45,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Setup Cygwin
-        uses: cygwin/cygwin-install-action@master
+        uses: cygwin/cygwin-install-action@3f0a3f9f988f7e96b8c18098ae05eaec175f5b52 # v6
         with:
           packages: ruby gcc-core make autoconf libtool libssl-devel libyaml-devel libffi-devel zlib-devel
 
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index e57cd86e2b3c7f..deae44bafd1990 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -9,4 +9,4 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/labeler@v5
+    - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index 6220df9f568786..f9531e6244bb12 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -164,7 +164,7 @@ jobs:
 
       - name: Resolve job ID
         id: job_id
-        uses: actions/github-script@main
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           matrix: ${{ toJson(matrix) }}
         with:
diff --git a/.github/workflows/modgc.yml b/.github/workflows/modgc.yml
index e7a1efe9d23743..ca694cfbf9640b 100644
--- a/.github/workflows/modgc.yml
+++ b/.github/workflows/modgc.yml
@@ -106,7 +106,7 @@ jobs:
           $SETARCH ../src/configure -C --disable-install-doc --with-modular-gc=${{ env.MODULAR_GC_DIR }}
           ${arch:+--target=$arch-$OSTYPE --host=$arch-$OSTYPE}
 
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
       - name: Set MMTk environment variables
         run: |
           echo 'EXCLUDES=../src/test/.excludes-mmtk' >> $GITHUB_ENV
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 25916066d68697..a1e94aea522bf4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -15,9 +15,9 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
-      - uses: ruby/setup-ruby@v1
+      - uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0
         with:
           ruby-version: 3.3.4
 
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 21f23ab8995790..8dbccef90451eb 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -89,7 +89,7 @@ jobs:
         shell: pwsh
 
       - name: Export GitHub Actions cache environment variables
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL || '');
diff --git a/.github/workflows/wsl.yml b/.github/workflows/wsl.yml
index e6b4133b76946c..54087f221f2af6 100644
--- a/.github/workflows/wsl.yml
+++ b/.github/workflows/wsl.yml
@@ -30,15 +30,15 @@ jobs:
 
     steps:
       - name: Install winget
-        uses: Cyberboss/install-winget@v1
+        uses: Cyberboss/install-winget@1c6f189175e9f015bf1aa113cd1cc6c73efb9d47 # v1.1.1
 
       - name: Install or update WSL
-        uses: Ubuntu/WSL/.github/actions/wsl-install@main
+        uses: Ubuntu/WSL/.github/actions/wsl-install@f861f1083e518354e4c3637b08c0edfcf8bc3d51 # main
         with:
           distro: Ubuntu-24.04
 
       - name: Install dependencies
-        uses: Ubuntu/WSL/.github/actions/wsl-bash@main
+        uses: Ubuntu/WSL/.github/actions/wsl-bash@f861f1083e518354e4c3637b08c0edfcf8bc3d51 # main
         with:
          distro: Ubuntu-24.04
          working-dir: /tmp/github/
@@ -47,14 +47,14 @@ jobs:
             DEBIAN_FRONTEND=noninteractive sudo apt install -y ruby build-essential autoconf libssl-dev libyaml-dev zlib1g-dev libgmp-dev libffi-dev
 
       - name: Check out the repository
-        uses: Ubuntu/WSL/.github/actions/wsl-checkout@main
+        uses: Ubuntu/WSL/.github/actions/wsl-checkout@f861f1083e518354e4c3637b08c0edfcf8bc3d51 # main
         with:
           distro: Ubuntu-24.04
           working-dir: /tmp/github/
           submodules: true
 
       - name: Build
-        uses: Ubuntu/WSL/.github/actions/wsl-bash@main
+        uses: Ubuntu/WSL/.github/actions/wsl-bash@f861f1083e518354e4c3637b08c0edfcf8bc3d51 # main
         with:
          distro: Ubuntu-24.04
          working-dir: /tmp/github/
@@ -66,7 +66,7 @@ jobs:
             make -j4
 
       - name: Test
-        uses: Ubuntu/WSL/.github/actions/wsl-bash@main
+        uses: Ubuntu/WSL/.github/actions/wsl-bash@f861f1083e518354e4c3637b08c0edfcf8bc3d51 # main
         with:
          distro: Ubuntu-24.04
          working-dir: /tmp/github/
diff --git a/.github/workflows/zjit-macos.yml b/.github/workflows/zjit-macos.yml
index 4a7a2fbf017df4..b31ea72996cbf8 100644
--- a/.github/workflows/zjit-macos.yml
+++ b/.github/workflows/zjit-macos.yml
@@ -74,7 +74,7 @@ jobs:
           # Set fetch-depth: 10 so that Launchable can receive commits information.
           fetch-depth: 10
 
-      - uses: taiki-e/install-action@v2
+      - uses: taiki-e/install-action@920ab1831fbf4fb3ef75c8ead83556c918bb7290 # v2.79.8
         with:
           tool: nextest@0.9
         if: ${{ matrix.test_task == 'zjit-test' }}
diff --git a/.github/workflows/zjit-ubuntu.yml b/.github/workflows/zjit-ubuntu.yml
index 2923fcf7bdd221..7d1c1513892bc0 100644
--- a/.github/workflows/zjit-ubuntu.yml
+++ b/.github/workflows/zjit-ubuntu.yml
@@ -78,7 +78,7 @@ jobs:
           ruby-version: '3.0'
           bundler: none
 
-      - uses: taiki-e/install-action@v2
+      - uses: taiki-e/install-action@920ab1831fbf4fb3ef75c8ead83556c918bb7290 # v2.79.8
         with:
           tool: nextest@0.9
         if: ${{ matrix.test_task == 'zjit-test' }}