diff --git a/.github/workflows/bootstrap.yaml b/.github/workflows/bootstrap.yaml
index 61f423e..9b18386 100644
--- a/.github/workflows/bootstrap.yaml
+++ b/.github/workflows/bootstrap.yaml
@@ -24,14 +24,14 @@ jobs:
     runs-on: ubuntu-24.04
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
       - name: Override AWS Region
         if: ${{ github.event.inputs.aws_region != '' }}
         run:
           echo "AWS_REGION=${{ github.event.inputs.aws_region }}" >> $GITHUB_ENV
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "22.x"
           cache: "npm"
@@ -41,7 +41,7 @@ jobs:
 
       # This will only work, if you've run `npx cdk deploy` once manually.
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
         with:
           # The role is set up via https://github.com/bifravst/ci
           # secrets.AWS_ACCOUNT_ID_CI is an organization secret
diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index 71c5944..91069d2 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -22,9 +22,9 @@ jobs:
     timeout-minutes: 5
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "22.x"
           cache: "npm"
@@ -34,7 +34,7 @@ jobs:
 
       # This will only work, if you've run `npx cdk deploy` once manually.
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
         with:
           # The role is set up via https://github.com/bifravst/ci
           # secrets.AWS_ACCOUNT_ID_CI is an organization secret
diff --git a/.github/workflows/test-and-release.yaml b/.github/workflows/test-and-release.yaml
index 28b96cf..70bf6ec 100644
--- a/.github/workflows/test-and-release.yaml
+++ b/.github/workflows/test-and-release.yaml
@@ -16,9 +16,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "22.x"
           cache: "npm"
diff --git a/.github/workflows/update-repo-info.yaml b/.github/workflows/update-repo-info.yaml
index 17e3665..dfa8d36 100644
--- a/.github/workflows/update-repo-info.yaml
+++ b/.github/workflows/update-repo-info.yaml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
       - name: Sync repository description
         run: