diff --git a/.github/workflows/build-ironic-images.yaml b/.github/workflows/build-ironic-images.yaml
index 2227ddbb..30db47cd 100644
--- a/.github/workflows/build-ironic-images.yaml
+++ b/.github/workflows/build-ironic-images.yaml
@@ -67,7 +67,7 @@ jobs:
         run: ls -la artifacts
 
       - name: Save artifacts for next job
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4
         with:
           name: image-artifacts
           path: ironic-images/artifacts/
@@ -119,7 +119,7 @@ jobs:
         run: echo "TIMESTAMP=$(git show --no-patch --no-notes --pretty='%cd' --date=format:'%Y%m%d%H%M%S' ${{ github.sha }})" >>  $GITHUB_ENV
 
       - name: Download artifacts from previous job
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
         with:
           name: image-artifacts
           path: ironic-images/artifacts
@@ -144,6 +144,6 @@ jobs:
 
     steps:
       - name: Clean up artifacts
-        uses: geekyeggo/delete-artifact@v5
+        uses: geekyeggo/delete-artifact@f275313e70c08f6120db482d7a6b98377786765b # v5
         with:
           name: image-artifacts
diff --git a/.github/workflows/code-test.yaml b/.github/workflows/code-test.yaml
index 72b2e243..ccc9feab 100644
--- a/.github/workflows/code-test.yaml
+++ b/.github/workflows/code-test.yaml
@@ -44,7 +44,7 @@ jobs:
       - run: poetry install --sync --with test
       - run: poetry build
       - run: "poetry run pytest --cov --cov-report xml:coverage.xml"
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4
         with:
           name: coverage-${{ matrix.project }}
           path: python/${{ matrix.project }}/coverage.xml
@@ -54,13 +54,13 @@ jobs:
     needs: python
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
         with:
           pattern: coverage-*
           merge-multiple: true
       - run: |
           npx cobertura-merge-globby -o output.xml --files=python/**/coverage.xml
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4
         with:
           name: coverage.xml
           path: coverage.xml
diff --git a/.github/workflows/coverage-report.yaml b/.github/workflows/coverage-report.yaml
index d4f0caba..4545469c 100644
--- a/.github/workflows/coverage-report.yaml
+++ b/.github/workflows/coverage-report.yaml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ github.event.workflow_run.conclusion == 'success' }}
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
         with:
           name: coverage.xml
           run-id: ${{ github.event.workflow_run.id }}