diff --git a/.github/workflows/fossa.yaml b/.github/workflows/fossa.yaml
index 92a977d..b6d7e05 100644
--- a/.github/workflows/fossa.yaml
+++ b/.github/workflows/fossa.yaml
@@ -11,10 +11,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1
         with:
           java-version: "17"
           distribution: "temurin"
@@ -23,13 +23,13 @@ jobs:
         run: ./gradlew build
 
       - name: Run FOSSA scan and upload build data
-        uses: fossas/fossa-action@main
+        uses: fossas/fossa-action@47ef11b1e1e3812e88dae436ccbd2d0cbd1adab0 # v1.3.3
         with:
           api-key: ${{ secrets.FOSSA_API_KEY }}
           branch: ${{ github.ref_name }}
 
       - name: Run FOSSA tests
-        uses: fossas/fossa-action@main
+        uses: fossas/fossa-action@47ef11b1e1e3812e88dae436ccbd2d0cbd1adab0 # v1.3.3
         with:
           api-key: ${{ secrets.FOSSA_API_KEY }}
           run-tests: true