diff --git a/.github/workflows/lint-test-matrix.yaml b/.github/workflows/lint-test-matrix.yaml
index d98c00e6..6116513f 100644
--- a/.github/workflows/lint-test-matrix.yaml
+++ b/.github/workflows/lint-test-matrix.yaml
@@ -19,7 +19,7 @@ jobs:
         - v1.31.0@sha256:53df588e04085fd41ae12de0c3fe4c72f7013bba32a20e7325357a1ac94ba865
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       with:
         fetch-depth: "0"
 
@@ -27,7 +27,7 @@ jobs:
       run: sudo apt-get -y install python3-wheel
 
     - name: Set up chart-testing
-      uses: helm/chart-testing-action@v2.6.1
+      uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992 # v2.6.1
 
     - name: Run chart-testing (list-changed)
       id: list-changed
@@ -42,7 +42,7 @@ jobs:
       run: ct lint --config ./default.ct.yaml
 
     - name: Create kind cluster
-      uses: helm/kind-action@v1.11.0
+      uses: helm/kind-action@ae94020eaf628e9b9b9f341a10cc0cdcf5c018fb # v1.11.0
       with:
         version: v0.24.0
         node_image: kindest/node:${{ matrix.kindest_node_version }}
diff --git a/.github/workflows/lint-test.yaml b/.github/workflows/lint-test.yaml
index 1f10caed..de290ee3 100644
--- a/.github/workflows/lint-test.yaml
+++ b/.github/workflows/lint-test.yaml
@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
     - name: Add dependency chart repos
       run: |
         helm repo add lagoon https://uselagoon.github.io/lagoon-charts/
@@ -52,7 +52,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       with:
         fetch-depth: "0"
 
@@ -60,7 +60,7 @@ jobs:
       run: sudo apt-get -y install python3-wheel
 
     - name: Set up chart-testing
-      uses: helm/chart-testing-action@v2.6.1
+      uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992 # v2.6.1
 
     - name: Run chart-testing (list-changed)
       id: list-changed
@@ -75,7 +75,7 @@ jobs:
       run: ct lint --config ./default.ct.yaml
 
     - name: Create kind cluster
-      uses: helm/kind-action@v1.11.0
+      uses: helm/kind-action@ae94020eaf628e9b9b9f341a10cc0cdcf5c018fb # v1.11.0
       with:
         version: v0.24.0
         node_image: kindest/node:v1.30.4@sha256:976ea815844d5fa93be213437e3ff5754cd599b040946b5cca43ca45c2047114
@@ -111,7 +111,7 @@ jobs:
       options: --user root
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - name: Run ah lint
         working-directory: ./charts/
         run: ah lint
@@ -121,7 +121,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       with:
         fetch-depth: "0"
 
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 19d1ae92..63d3525d 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       with:
         fetch-depth: "0"
 
@@ -27,7 +27,7 @@ jobs:
         helm repo add kube-logging https://kube-logging.github.io/helm-charts
 
     - name: Run chart-releaser
-      uses: helm/chart-releaser-action@v1.6.0
+      uses: helm/chart-releaser-action@a917fd15b20e8b64b94d9158ad54cd6345335584 # v1.6.0
       env:
         CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
         # don't upload a chart if an existing tag exists
diff --git a/.github/workflows/test-suite.yaml b/.github/workflows/test-suite.yaml
index 6220282d..4e608d59 100644
--- a/.github/workflows/test-suite.yaml
+++ b/.github/workflows/test-suite.yaml
@@ -35,12 +35,12 @@ jobs:
     steps:
     # Continue after getting a shell via: `touch continue`
     - name: Setup tmate session
-      uses: mxschmitt/action-tmate@v3
+      uses: mxschmitt/action-tmate@e5c7151931ca95bad1c6f4190c730ecf8c7dde48 # v3
       timeout-minutes: 1
       continue-on-error: true
 
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       with:
         fetch-depth: "0"
 
@@ -48,7 +48,7 @@ jobs:
       run: sudo apt-get -y install python3-wheel
 
     - name: Set up chart-testing
-      uses: helm/chart-testing-action@v2.6.1
+      uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992 # v2.6.1
 
     - name: Run chart-testing (list-changed)
       id: list-changed
@@ -71,7 +71,7 @@ jobs:
         envsubst < test-suite.kind-config.yaml.tpl > test-suite.kind-config.yaml
 
     - name: Create kind cluster
-      uses: helm/kind-action@v1.11.0
+      uses: helm/kind-action@ae94020eaf628e9b9b9f341a10cc0cdcf5c018fb # v1.11.0
       if: |
         (steps.list-changed.outputs.changed == 'true') ||
         (contains(github.event.pull_request.labels.*.name, 'needs-testing')) ||