diff --git a/.github/workflows/fetch-licenses.yaml b/.github/workflows/fetch-licenses.yaml
index 37b2409..226ae9a 100644
--- a/.github/workflows/fetch-licenses.yaml
+++ b/.github/workflows/fetch-licenses.yaml
@@ -24,10 +24,10 @@ jobs:
                   git config --global user.email "github-actions[bot]@users.noreply.github.com"
 
             - name: Checkout this repository
-              uses: actions/checkout@v7
+              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
             - name: Checkout official SPDX Repository
-              uses: actions/checkout@v7
+              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                   repository: spdx/license-list-data
                   path: official-spdx-licenses # creates a tmp dir to hold the SPDX licenses from the official repo
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index 1d29df3..6c84780 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -13,8 +13,8 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-go@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: "1.24.7"
 
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index dfd8b8d..d7a9860 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -14,8 +14,8 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-go@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: "1.24.7"