diff --git a/.github/workflows/bandit.yaml b/.github/workflows/bandit.yaml
index 905d04d390..ec6f1c6972 100644
--- a/.github/workflows/bandit.yaml
+++ b/.github/workflows/bandit.yaml
@@ -6,7 +6,7 @@ jobs:
         container:
             image: archlinux/archlinux:latest
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
             - run: pacman --noconfirm -Syu bandit
             - name: Security checkup with Bandit
               run: bandit -r archinstall || exit 0
diff --git a/.github/workflows/flake8.yaml b/.github/workflows/flake8.yaml
index 923a2bd50d..45cfa79083 100644
--- a/.github/workflows/flake8.yaml
+++ b/.github/workflows/flake8.yaml
@@ -6,7 +6,7 @@ jobs:
         container:
             image: archlinux/archlinux:latest
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
             - name: Prepare arch
               run: |
                 pacman-key --init
diff --git a/.github/workflows/github-pages.yml b/.github/workflows/github-pages.yml
index a656ef346f..3d8801f9d3 100644
--- a/.github/workflows/github-pages.yml
+++ b/.github/workflows/github-pages.yml
@@ -21,8 +21,8 @@ jobs:
       image: archlinux/archlinux:latest
       options: --privileged
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
       - name: Install pre-dependencies
         run: |
           pacman -Sy --noconfirm tree git python-pyparted python-setuptools python-sphinx python-sphinx_rtd_theme python-build python-installer python-wheel
@@ -30,7 +30,7 @@ jobs:
         run: |
           sphinx-build docs _build
       - name: Deploy to GitHub Pages
-        uses: peaceiris/actions-gh-pages@v4
+        uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4
         if: ${{ github.event_name != 'pull_request' }}
         with:
           publish_branch: gh-pages
diff --git a/.github/workflows/iso-build.yaml b/.github/workflows/iso-build.yaml
index b86c47ecfc..08f0e211c3 100644
--- a/.github/workflows/iso-build.yaml
+++ b/.github/workflows/iso-build.yaml
@@ -26,14 +26,14 @@ jobs:
       image: archlinux/archlinux:latest
       options: --privileged
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - run: pwd
       - run: find .
       - run: cat /etc/os-release
       - run: pacman-key --init
       - run: pacman --noconfirm -Sy archlinux-keyring
       - run: ./build_iso.sh
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: Arch Live ISO
           path: /tmp/archlive/out/*.iso
diff --git a/.github/workflows/mypy.yaml b/.github/workflows/mypy.yaml
index fc2bec97d0..0d630e3f20 100644
--- a/.github/workflows/mypy.yaml
+++ b/.github/workflows/mypy.yaml
@@ -6,7 +6,7 @@ jobs:
         container:
             image: archlinux/archlinux:latest
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
             - name: Prepare arch
               run: |
                 pacman-key --init
diff --git a/.github/workflows/pylint.yaml b/.github/workflows/pylint.yaml
index 99178aa6b2..93ac4baf39 100644
--- a/.github/workflows/pylint.yaml
+++ b/.github/workflows/pylint.yaml
@@ -6,7 +6,7 @@ jobs:
         container:
             image: archlinux/archlinux:latest
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
             - name: Prepare arch
               run: |
                 pacman-key --init
diff --git a/.github/workflows/pytest.yaml b/.github/workflows/pytest.yaml
index 86535ba5b4..1cac5dbd11 100644
--- a/.github/workflows/pytest.yaml
+++ b/.github/workflows/pytest.yaml
@@ -7,7 +7,7 @@ jobs:
             image: archlinux/archlinux:latest
             options: --privileged
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
             - name: Prepare arch
               run: |
                 pacman-key --init
diff --git a/.github/workflows/python-build.yml b/.github/workflows/python-build.yml
index 8c413dae03..a246e4aa69 100644
--- a/.github/workflows/python-build.yml
+++ b/.github/workflows/python-build.yml
@@ -11,7 +11,7 @@ jobs:
       image: archlinux/archlinux:latest
       options: --privileged
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - name: Prepare arch
         run: |
           pacman-key --init
@@ -33,7 +33,7 @@ jobs:
           archinstall --script guided -v
           archinstall --script only_hd -v
           archinstall --script minimal -v
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: archinstall
           path: dist/*
diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml
index 0cf7178395..8d0d5cf88d 100644
--- a/.github/workflows/python-publish.yml
+++ b/.github/workflows/python-publish.yml
@@ -13,9 +13,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
         with:
           python-version: '3.x'
       - name: Install dependencies
diff --git a/.github/workflows/ruff.yaml b/.github/workflows/ruff.yaml
index 633cb311d9..b28f17e210 100644
--- a/.github/workflows/ruff.yaml
+++ b/.github/workflows/ruff.yaml
@@ -4,5 +4,5 @@ jobs:
     ruff:
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
             - uses: astral-sh/ruff-action@9828f49eb4cadf267b40eaa330295c412c68c1f9  # v3.2.2