diff --git a/.github/workflows/__build-workflow.yaml b/.github/workflows/__build-workflow.yaml
index 897e2e5689..9b3b0ca1c8 100644
--- a/.github/workflows/__build-workflow.yaml
+++ b/.github/workflows/__build-workflow.yaml
@@ -231,7 +231,7 @@ jobs:
           outputs: |
             ${{ !inputs.push && 'type=docker,dest=/tmp/image.tar' }}
 
-      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
         with:
           platforms: ${{ matrix.arch }}
 
diff --git a/.github/workflows/backport.yaml b/.github/workflows/backport.yaml
index dfeb7260bc..24fe1159f5 100644
--- a/.github/workflows/backport.yaml
+++ b/.github/workflows/backport.yaml
@@ -22,6 +22,6 @@ jobs:
         )
       )
     steps:
-      - uses: tibdex/backport@v2
+      - uses: tibdex/backport@9565281eda0731b1d20c4025c43339fb0a23812e # v2.0.4
         with:
           github_token: ${{ secrets.PAT_GITHUB }}