diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 76841a1..b4ad1f5 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -15,12 +15,12 @@ jobs:
         python-version: ["3.14"]
 
     steps:
-      - uses: "actions/checkout@v6.0.2"
+      - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
         with:
           persist-credentials: false
 
       - name: "Set up Python ${{ matrix.python-version }}"
-        uses: "actions/setup-python@v6"
+        uses: "actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405"  # v6
         with:
           python-version: "${{ matrix.python-version }}"
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3c1e774..9a3baf7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,12 +11,12 @@ jobs:
   build-and-release:
     runs-on: "ubuntu-latest"
     steps:
-      - uses: "actions/checkout@v6.0.2"
+      - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
         with:
           persist-credentials: false
 
       - name: "Set up Python"
-        uses: "actions/setup-python@v6"
+        uses: "actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405"  # v6
         with:
           python-version: "3.12"
 
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 64dd78d..b27d803 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -21,12 +21,12 @@ jobs:
           - "PySide"
 
     steps:
-      - uses: "actions/checkout@v6.0.2"
+      - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
         with:
           persist-credentials: false
 
       - name: "Set up Python ${{ matrix.python-version }}"
-        uses: "actions/setup-python@v6"
+        uses: "actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405"  # v6
         with:
           python-version: "${{ matrix.python-version }}"