diff --git a/.github/workflows/daily-pr-review-health.yml b/.github/workflows/daily-pr-review-health.yml
index a4505eda3..56f4ea953 100644
--- a/.github/workflows/daily-pr-review-health.yml
+++ b/.github/workflows/daily-pr-review-health.yml
@@ -42,7 +42,7 @@ jobs:
           node-version: '20'
 
       - name: Cache claude-code CLI
-        uses: actions/cache@v5.0.5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
         with:
           path: ~/.npm-global
           key: claude-code-${{ env.CLAUDE_CODE_VERSION }}-${{ runner.os }}
diff --git a/.github/workflows/repair-pr-approvals.yml b/.github/workflows/repair-pr-approvals.yml
index 0df095892..d8cfbeecf 100644
--- a/.github/workflows/repair-pr-approvals.yml
+++ b/.github/workflows/repair-pr-approvals.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
       - name: Repair PR approvals
         env:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index bcf7efafa..c20eb4b57 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
       - name: Run copilot_chat tests
         run: bash tests/test_copilot_chat.sh