diff --git a/.github/workflows/cache-maven-dependencies.yaml b/.github/workflows/cache-maven-dependencies.yaml
index 7e573ffdc..819aad05a 100644
--- a/.github/workflows/cache-maven-dependencies.yaml
+++ b/.github/workflows/cache-maven-dependencies.yaml
@@ -22,7 +22,7 @@ jobs:
           ref: ${{ env.MAVEN_CACHE_REF }}
 
       - name: "Setup Java"
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.6.0
         with:
           distribution: "sapmachine"
           java-version: 17
diff --git a/.github/workflows/continuous-integration.yaml b/.github/workflows/continuous-integration.yaml
index 1b7a4e41a..ba8ded87e 100644
--- a/.github/workflows/continuous-integration.yaml
+++ b/.github/workflows/continuous-integration.yaml
@@ -92,7 +92,7 @@ jobs:
           ref: ${{ needs.context.outputs.commit }}
 
       - name: "Setup Java"
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.6.0
         with:
           distribution: "sapmachine"
           java-version: 17
@@ -121,7 +121,7 @@ jobs:
           ref: ${{ needs.context.outputs.commit }}
 
       - name: "Setup java"
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.6.0
         with:
           distribution: "sapmachine"
           java-version: 17
@@ -177,7 +177,7 @@ jobs:
           ref: ${{ needs.context.outputs.commit }}
 
       - name: "Setup java"
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.6.0
         with:
           distribution: "sapmachine"
           java-version: 17
@@ -240,7 +240,7 @@ jobs:
           ref: ${{ needs.context.outputs.commit }}
 
       - name: "Setup java"
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.6.0
         with:
           distribution: "sapmachine"
           java-version: 17
@@ -284,7 +284,7 @@ jobs:
           ref: ${{ needs.context.outputs.commit }}
 
       - name: "Setup java"
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.6.0
         with:
           distribution: "sapmachine"
           java-version: 17
@@ -297,7 +297,7 @@ jobs:
           path: ${{ env.MAVEN_CACHE_DIR }}
 
       - name: "Initialize CodeQL"
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@v4.37.3
         with:
           languages: "java"
           queries: security-extended
@@ -309,7 +309,7 @@ jobs:
           mvn $MVN_ARGS
 
       - name: "Perform CodeQL Analysis"
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@v4.37.3
         with:
           category: "/language:java"
 
@@ -329,7 +329,7 @@ jobs:
     name: "Test ${{ matrix.task.archetype }} Archetype"
     steps:
       - name: "Setup java"
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.6.0
         with:
           distribution: "sapmachine"
           java-version: 17
diff --git a/.github/workflows/deploy-snapshot.yaml b/.github/workflows/deploy-snapshot.yaml
index 9839e3ace..ca7353c7b 100644
--- a/.github/workflows/deploy-snapshot.yaml
+++ b/.github/workflows/deploy-snapshot.yaml
@@ -16,7 +16,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: "Setup java"
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.6.0
         with:
           distribution: "sapmachine"
           java-version: "17"
diff --git a/.github/workflows/javadoc.yaml b/.github/workflows/javadoc.yaml
index 454773ea1..e63985790 100644
--- a/.github/workflows/javadoc.yaml
+++ b/.github/workflows/javadoc.yaml
@@ -35,7 +35,7 @@ jobs:
         run: git checkout "${{ github.event.inputs.branch || 'main' }}"
 
       - name: 'Set up JDK 17'
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.6.0
         with:
           java-version: '17'
           distribution: 'temurin'
diff --git a/.github/workflows/perform-release.yml b/.github/workflows/perform-release.yml
index 3689ad6fc..4c8894217 100644
--- a/.github/workflows/perform-release.yml
+++ b/.github/workflows/perform-release.yml
@@ -125,7 +125,7 @@ jobs:
           permission-pull-requests: write # needed to merge the release PR
 
       - name: 'Setup java'
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.6.0
         with:
           distribution: 'sapmachine'
           java-version: ${{ env.JAVA_VERSION }}
diff --git a/.github/workflows/prepare-release.yaml b/.github/workflows/prepare-release.yaml
index cc1ed1c36..1402d12b7 100644
--- a/.github/workflows/prepare-release.yaml
+++ b/.github/workflows/prepare-release.yaml
@@ -129,7 +129,7 @@ jobs:
           ref: ${{ needs.bump-version.outputs.release-branch }}
 
       - name: 'Setup java'
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.6.0
         with:
           distribution: 'sapmachine'
           java-version: ${{ env.JAVA_VERSION }}