diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index c67d40c..334a55b 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -14,9 +14,9 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.1.5
+        uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
       - name: Label actions
-        uses: micnncim/action-label-syncer@v1.3.0
+        uses: micnncim/action-label-syncer@3abd5ab72fda571e69fffd97bd4e0033dd5f495c # v1.3.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 4a615a9..ca29a9e 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.1.5
+        uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
         with:
           ref: ${{ github.head_ref }}
       - name: Get the version name from the tags
@@ -19,13 +19,13 @@ jobs:
         run: |
           sed -Ei "s/^version: .*/version: ${{ env.RELEASE_VERSION }}/" galaxy.yml
       - name: Commit galaxy.yml
-        uses: stefanzweifel/git-auto-commit-action@v5.0.1
+        uses: stefanzweifel/git-auto-commit-action@8621497c8c39c72f3e2a999a26b4ca1b5058a842 # v5.0.1
         with:
           branch: main
           commit_message: "Update galaxy.yml for ${{ env.RELEASE_VERSION }}"
           file_pattern: galaxy.yml
       - name: Publish collection
-        uses: docker://ghcr.io/artis3n/ansible_galaxy_collection:v2.10.1
+        uses: docker://ghcr.io/artis3n/ansible_galaxy_collection:v2.10.1@sha256:512e8de7c7bb22e53ceadef302a2b181045895fa468540761d4ab1e7247ba68c
         with:
           api_key: '${{ secrets.ANSIBLE_GALAXY_API_KEY }}'
           galaxy_version: '${{ env.RELEASE_VERSION }}'
diff --git a/.github/workflows/release-drafter.yaml b/.github/workflows/release-drafter.yaml
index af672bf..5b2ceb8 100644
--- a/.github/workflows/release-drafter.yaml
+++ b/.github/workflows/release-drafter.yaml
@@ -19,6 +19,6 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Run Release Drafter
-        uses: release-drafter/release-drafter@v6.0.0
+        uses: release-drafter/release-drafter@3f0f87098bd6b5c5b9a36d49c41d998ea58f9348 # v6.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 670c6c8..cd6b11d 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -7,7 +7,7 @@ jobs:
   stale:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/stale@v9.0.0
+      - uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # v9.0.0
         with:
           stale-issue-message: |-
             This issue has been marked 'stale' due to lack of recent activity. If there is no further activity, the issue will be closed in another 30 days. Thank you for your contribution!
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 8e47e5f..6962f32 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -21,9 +21,9 @@ jobs:
       scenario: ${{ steps.filter.outputs.changes }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.1.5
+        uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
       - name: Detect changes
-        uses: dorny/paths-filter@v3.0.2
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
         id: filter
         with:
           filters: |
@@ -51,7 +51,7 @@ jobs:
         scenario: ${{ fromJSON(needs.changes.outputs.scenario) }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.1.5
+        uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
         with:
           path: ansible_collections/vladgh/samba
       - name: Molecule test