diff --git a/.github/workflows/code.yml b/.github/workflows/code.yml
index 135c3711e00..aab0940487e 100644
--- a/.github/workflows/code.yml
+++ b/.github/workflows/code.yml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Code Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
         with:
           persist-credentials: false
           fetch-depth: 0
diff --git a/.github/workflows/go-spectest.yml b/.github/workflows/go-spectest.yml
index e2188643b5e..0ba433ddeae 100644
--- a/.github/workflows/go-spectest.yml
+++ b/.github/workflows/go-spectest.yml
@@ -23,18 +23,18 @@ jobs:
     name: Vagrant acceptance tests
     steps:
       - name: Code Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
         with:
           submodules: 'recursive'
           # Also fetch all tags, since we need our version number in the build
           # to be based off a tag
           fetch-depth: 0
       - name: Setup Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
         with:
           go-version: ${{matrix.go}}
       - name: Setup Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@7d546f4868fb108ed378764d873683f920672ae2 # v1.149.0
         with:
           ruby-version: ${{matrix.ruby}}
           bundler-cache: true
diff --git a/.github/workflows/go-testing.yml b/.github/workflows/go-testing.yml
index 43640fbb153..436ebb44775 100644
--- a/.github/workflows/go-testing.yml
+++ b/.github/workflows/go-testing.yml
@@ -30,13 +30,13 @@ jobs:
     name: Vagrant unit tests on Go
     steps:
       - name: Code Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
       - name: Setup Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
         with:
           go-version: ${{matrix.go}}
       - name: Setup Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@7d546f4868fb108ed378764d873683f920672ae2 # v1.149.0
         with:
           ruby-version: ${{matrix.ruby}}
           bundler-cache: true
diff --git a/.github/workflows/lock.yml b/.github/workflows/lock.yml
index 00e28e06664..32c96442eab 100644
--- a/.github/workflows/lock.yml
+++ b/.github/workflows/lock.yml
@@ -11,7 +11,7 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: dessant/lock-threads@v2
+      - uses: dessant/lock-threads@c1b35aecc5cdb1a34539d14196df55838bb2f836 # v4.0.0
         with:
           github-token: ${{ github.token }}
           issue-lock-inactive-days: '30'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f939e4af6c1..3048c37a8d2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Code Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
       - name: Trigger Build
         run: ./.ci/release
         env:
diff --git a/.github/workflows/spectesting.yml b/.github/workflows/spectesting.yml
index 673bbd3e612..e925054c954 100644
--- a/.github/workflows/spectesting.yml
+++ b/.github/workflows/spectesting.yml
@@ -29,7 +29,7 @@ jobs:
             kv/data/teams/vagrant/packet project_id | packet_project_id;
             kv/data/teams/vagrant/packet ssh_key_content | packet_ssh_key_content;
       - name: Code Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
       - name: Create packet instance
         run: ./.ci/spec/create-packet.sh
         working-directory: ${{github.workspace}}
@@ -50,7 +50,7 @@ jobs:
         providers: ['virtualbox', 'docker']
     steps:
       - name: Code Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
         with:
           submodules: 'recursive'
       - name: Create hosts for tests (provider ${{ matrix.providers }})
@@ -104,7 +104,7 @@ jobs:
           VAGRANT_DOCKER_IMAGES: ${{matrix.docker_images}}
       - name: Upload log
         if: always()
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
         with:
           name: vagrant-spec-${{matrix.providers}}.log
           path: ${{ github.workspace }}/vagrant-spec.log
diff --git a/.github/workflows/testing.yml b/.github/workflows/testing.yml
index a987d9a2ea8..ea1a289d331 100644
--- a/.github/workflows/testing.yml
+++ b/.github/workflows/testing.yml
@@ -35,9 +35,9 @@ jobs:
     name: Vagrant unit tests on Ruby ${{ matrix.ruby }}
     steps:
       - name: Code Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
       - name: Setup Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@7d546f4868fb108ed378764d873683f920672ae2 # v1.149.0
         with:
           ruby-version: ${{matrix.ruby}}
           bundler-cache: true