diff --git a/.github/workflows/build-individual.yml b/.github/workflows/build-individual.yml
index 8fc3ffb..0a4ea77 100644
--- a/.github/workflows/build-individual.yml
+++ b/.github/workflows/build-individual.yml
@@ -11,22 +11,22 @@ jobs:
   build-individual:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - uses: hustcer/setup-nu@v3.13
+      - uses: hustcer/setup-nu@0000000ae6a4e242e802c943f465373b70b07469 # v3.17
         with:
           version: v0.93
 
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       
-      - uses: sigstore/cosign-installer@v3.6.0
+      - uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1
 
       - name: Run build and push script
         run: nu ./build-individual.nu
diff --git a/.github/workflows/build-unified.yml b/.github/workflows/build-unified.yml
index 15a4c72..52e3e86 100644
--- a/.github/workflows/build-unified.yml
+++ b/.github/workflows/build-unified.yml
@@ -11,22 +11,22 @@ jobs:
   build-unified:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - uses: hustcer/setup-nu@v3.13
+      - uses: hustcer/setup-nu@0000000ae6a4e242e802c943f465373b70b07469 # v3.17
         with:
           version: v0.93
 
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       
-      - uses: sigstore/cosign-installer@v3.6.0
+      - uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1
 
       - name: Run build and push script
         run: nu ./build-unified.nu
diff --git a/.github/workflows/reviewdog.yml b/.github/workflows/reviewdog.yml
index d6373e3..aa520d2 100644
--- a/.github/workflows/reviewdog.yml
+++ b/.github/workflows/reviewdog.yml
@@ -7,9 +7,9 @@ jobs:
     name: runner / shellcheck
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: shellcheck
-        uses: reviewdog/action-shellcheck@v1
+        uses: reviewdog/action-shellcheck@6e0e63d1750d02d761b3df0f2c5ba9f9ac4a9ed7 # v1.29.0
         with:
           github_token: ${{ github.token }}
           reporter: github-pr-review
\ No newline at end of file