diff --git a/.github/workflows/yocto-build-deploy.yml b/.github/workflows/yocto-build-deploy.yml
index 32a6814fe..59b37fdb4 100644
--- a/.github/workflows/yocto-build-deploy.yml
+++ b/.github/workflows/yocto-build-deploy.yml
@@ -440,7 +440,7 @@ jobs:
       # The github-script action is a safer method of writing to outputs and variables, vs a shell step.
       # https://github.com/actions/github-script
       - name: Enable mirror tarballs
-        uses: actions/github-script@v7.0.1
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           script: |
             const currentValue = process.env.BARYS_ARGUMENTS_VAR || '';
@@ -529,7 +529,7 @@ jobs:
       # https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows
       - name: Restore sstate cache
         id: sstate-restore
-        uses: tespkg/actions-cache/restore@v1.7.1
+        uses: tespkg/actions-cache/restore@cba095d7af782a955b8f4fa13396fbf0ab62bd4b # v1.7.1
         with:
           endpoint: minio
           port: 9000
@@ -589,7 +589,7 @@ jobs:
       # https://github.com/tespkg/actions-cache
       # https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows
       - name: Save sstate cache
-        uses: tespkg/actions-cache/save@v1.7.1
+        uses: tespkg/actions-cache/save@cba095d7af782a955b8f4fa13396fbf0ab62bd4b # v1.7.1
         # Do not save cache for pull_request_target events
         # as they run in the context of the main branch and would be vulnerable to cache poisoning.
         # https://0xn3va.gitbook.io/cheat-sheets/ci-cd/github/actions#cache-poisoning