diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 4da3044d..d9a31ce9 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -62,14 +62,14 @@ jobs:
 
       - name: Generate JaCoCo Badge
         if: ${{ github.ref == 'refs/heads/main' && matrix.java == 17 }}
-        uses: cicirello/jacoco-badge-generator@v2
+        uses: cicirello/jacoco-badge-generator@72266185b7ee48a6fd74eaf0238395cc8b14fef8 # v2
         with:
           jacoco-csv-file: coverage-report/target/site/jacoco-aggregate/jacoco.csv
           badges-directory: coverage-report/target/site/jacoco-aggregate
 
       - name: Publish coverage report to GitHub Pages
         if: ${{ github.ref == 'refs/heads/main' && matrix.java == 17 }}
-        uses: JamesIves/github-pages-deploy-action@v4
+        uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f # v4
         with:
           branch: docs
           folder: coverage-report/target/site/jacoco-aggregate
@@ -77,7 +77,7 @@ jobs:
 
       - name: Deploy javadoc to Github Pages
         if: ${{ github.ref == 'refs/heads/main' && matrix.java == 17 }}
-        uses: MathieuSoysal/Javadoc-publisher.yml@v3.0.2
+        uses: MathieuSoysal/Javadoc-publisher.yml@fda475b197081ba1eca7a1dfadf0c017080a1623 # v3.0.2
         with:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           javadoc-branch: docs
diff --git a/.github/workflows/notify_slack.yml b/.github/workflows/notify_slack.yml
index 056a6352..db3eb73e 100644
--- a/.github/workflows/notify_slack.yml
+++ b/.github/workflows/notify_slack.yml
@@ -18,7 +18,7 @@ jobs:
           node-version: '24.x'
       - name: Send issue notification to Slack
         if: github.event_name == 'issues'
-        uses: slackapi/slack-github-action@v3.0.1
+        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
         with:
           webhook: ${{ secrets.SLACK_WEBHOOK_URL_ISSUE }}
           webhook-type: incoming-webhook
@@ -31,7 +31,7 @@ jobs:
 
       - name: Send pull request notification to Slack
         if: github.event_name == 'pull_request_target'
-        uses: slackapi/slack-github-action@v3.0.1
+        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
         with:
           webhook: ${{ secrets.SLACK_WEBHOOK_URL_PR }}
           webhook-type: incoming-webhook
diff --git a/.github/workflows/release_maven.yml b/.github/workflows/release_maven.yml
index ad007603..c9c46bfd 100644
--- a/.github/workflows/release_maven.yml
+++ b/.github/workflows/release_maven.yml
@@ -60,7 +60,7 @@ jobs:
           git commit -m "chore: release version ${{ github.event.inputs.release_version }}"
       
       - name: Push changes
-        uses: ad-m/github-push-action@master
+        uses: ad-m/github-push-action@4cc74773234f74829a8c21bc4d69dd4be9cfa599 # master
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
 
@@ -68,7 +68,7 @@ jobs:
         run: mvn clean install -q -Dlog4j2.level=WARN -Dlog4j.configurationFile=log4j2-quiet.xml --no-transfer-progress
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2
         with:
           tag_name: v${{ github.event.inputs.release_version }}
           name: Release v${{ github.event.inputs.release_version }}
@@ -100,6 +100,6 @@ jobs:
           git commit -m "chore: bump version to ${{ github.event.inputs.next_version }}"
       
       - name: Push changes
-        uses: ad-m/github-push-action@master
+        uses: ad-m/github-push-action@4cc74773234f74829a8c21bc4d69dd4be9cfa599 # master
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}