diff --git a/.github/workflows/ci-build.yml b/.github/workflows/ci-build.yml
index 720d286..c5906b0 100644
--- a/.github/workflows/ci-build.yml
+++ b/.github/workflows/ci-build.yml
@@ -14,12 +14,12 @@ jobs:
     name: windows-latest
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
 
       - name: 'Setup Java JDK 11'
-        uses: actions/setup-java@v4.7.1
+        uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4.9.1
         with:
           distribution: 'microsoft'
           java-version: '11'
@@ -30,7 +30,7 @@ jobs:
           dotnet workload install android ios tvos macos maui maccatalyst wasm-tools-net7 
 
       - name: 'Cache: .nuke/temp, ~/.nuget/packages'
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: |
             .nuke/temp
diff --git a/.github/workflows/lock.yml b/.github/workflows/lock.yml
index 6bf7b1f..05bcc91 100644
--- a/.github/workflows/lock.yml
+++ b/.github/workflows/lock.yml
@@ -16,7 +16,7 @@ jobs:
   action:
     runs-on: ubuntu-latest
     steps:
-      - uses: dessant/lock-threads@v5
+      - uses: dessant/lock-threads@1bf7ec25051fe7c00bdd17e6a7cf3d7bfb7dc771 # v5
         with:
           github-token: ${{ github.token }}
           issue-inactive-days: '14'