diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ce9510e103..59e1ca87b4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -62,7 +62,7 @@ jobs:
         node-version: [20.x, 22.x, 24.x]
 
     steps:
-      - uses: socketdev/action@v1
+      - uses: socketdev/action@937f824ec476dfd164d4a4d9995751427b0be143 # v1.3.0
         with:
           mode: firewall-free
 
@@ -132,7 +132,7 @@ jobs:
         check: ['lint', 'format', 'commit-lint', 'dependencies', 'scripts']
 
     steps:
-      - uses: socketdev/action@v1
+      - uses: socketdev/action@937f824ec476dfd164d4a4d9995751427b0be143 # v1.3.0
         with:
           mode: firewall-free
 
@@ -189,7 +189,7 @@ jobs:
     if: always() && (needs.changes.result == 'skipped' || needs.changes.outputs.source == 'true')
 
     steps:
-      - uses: socketdev/action@v1
+      - uses: socketdev/action@937f824ec476dfd164d4a4d9995751427b0be143 # v1.3.0
         with:
           mode: firewall-free
 
@@ -385,7 +385,7 @@ jobs:
     if: always() && (needs.changes.result == 'skipped' || needs.changes.outputs.docker == 'true')
 
     steps:
-      - uses: socketdev/action@v1
+      - uses: socketdev/action@937f824ec476dfd164d4a4d9995751427b0be143 # v1.3.0
         with:
           mode: firewall-free
 
diff --git a/.github/workflows/iyarc-prune.yml b/.github/workflows/iyarc-prune.yml
index 223674b2e3..1adb4639de 100644
--- a/.github/workflows/iyarc-prune.yml
+++ b/.github/workflows/iyarc-prune.yml
@@ -70,7 +70,7 @@ jobs:
 
       - name: Run Claude Code (Bedrock)
         id: claude
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@459ad358ae43fea66bfefd0a1f8d840b4b9791fb # v1.0.194
         with:
           prompt: ${{ steps.agent.outputs.content }}
           use_commit_signing: 'true'