diff --git a/.github/workflows/build-test-template.yml b/.github/workflows/build-test-template.yml
index 9e4e8d19..e529b2c8 100644
--- a/.github/workflows/build-test-template.yml
+++ b/.github/workflows/build-test-template.yml
@@ -31,25 +31,25 @@ jobs:
       packages: read
       contents: read
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         fetch-depth: 0
 
     - name: Setup .NET
-      uses: actions/setup-dotnet@v4
+      uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
       with:
         dotnet-version: |
           8.0.x
           ${{ env.DOTNET_VERSION }}
 
     - name: Setup JDK
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4
       with:
         distribution: 'microsoft'
         java-version: ${{ env.JAVA_VERSION }}
 
     - name: Cache SonarCloud packages
-      uses: actions/cache@v4
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       with:
         path: ~/.sonar/cache
         key: ${{ runner.os }}-sonar
diff --git a/.github/workflows/continuous-integration-terraform.yml b/.github/workflows/continuous-integration-terraform.yml
index 92faa7ef..837016bc 100644
--- a/.github/workflows/continuous-integration-terraform.yml
+++ b/.github/workflows/continuous-integration-terraform.yml
@@ -15,10 +15,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
       - name: Terraform Validate
-        uses: DFE-Digital/terraform-linting-actions/.github/actions/validate@v1.2.1
+        uses: DFE-Digital/terraform-linting-actions/.github/actions/validate@2608ca06a7f06e1869364c028a8d035d23627acc # v1.2.1
         with:
           terraform_version: '1.10.5'
           tflint_version: 'v0.44.1'
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index f02c04f5..da9e12f0 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -57,7 +57,7 @@ jobs:
     needs: [ set-env ]
     steps:
       - name: Validate Packages
-        uses: DFE-Digital/rsd-github-actions/.github/actions/validate-packages@v1
+        uses: DFE-Digital/rsd-github-actions/.github/actions/validate-packages@769212b22326c2c43b49739b883683f97098e2ea # v1
         with:
           environment: ${{ needs.set-env.outputs.environment }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/pack-template.yml b/.github/workflows/pack-template.yml
index 51bdb3f3..b740ef0d 100644
--- a/.github/workflows/pack-template.yml
+++ b/.github/workflows/pack-template.yml
@@ -24,19 +24,19 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
 
       - name: Setup .NET SDK
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
         with:
           dotnet-version: |
             8.0.x
             10.0.x
 
       - name: Install GitVersion
-        uses: gittools/actions/gitversion/setup@v4.5.0
+        uses: gittools/actions/gitversion/setup@bc6623af8fc07d5a8903052dd46da33403eec8e8 # v4.5.0
         with:
           versionSpec: '6.7.x'