diff --git a/.github/workflows/docker-release.yaml b/.github/workflows/docker-release.yaml
index 811a3c5..8d883ec 100644
--- a/.github/workflows/docker-release.yaml
+++ b/.github/workflows/docker-release.yaml
@@ -29,7 +29,7 @@ on:
 
 jobs:
   release:
-    uses: mirceanton/reusable-workflows/.github/workflows/reusable-docker-build-push.yaml@v3.4.19
+    uses: mirceanton/reusable-workflows/.github/workflows/reusable-docker-build-push.yaml@f4dce998a168bbe2e53664acf4dd29407cd3d29f # v3.4.19
     secrets: inherit
     with:
       image: "ghcr.io/${{ github.repository }}"
diff --git a/.github/workflows/gh-pages.yml b/.github/workflows/gh-pages.yml
index 87e8851..6a2bac3 100644
--- a/.github/workflows/gh-pages.yml
+++ b/.github/workflows/gh-pages.yml
@@ -54,7 +54,7 @@ jobs:
         run: bundle exec jekyll build --trace
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
         with:
           path: ./website/_site
 
@@ -77,6 +77,6 @@ jobs:
 
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
         with:
           token: "${{ steps.app-token.outputs.token }}"
diff --git a/.github/workflows/git-release.yaml b/.github/workflows/git-release.yaml
index ea15526..389700d 100644
--- a/.github/workflows/git-release.yaml
+++ b/.github/workflows/git-release.yaml
@@ -14,5 +14,5 @@ on:
 
 jobs:
   release:
-    uses: mirceanton/reusable-workflows/.github/workflows/reusable-release-calver.yaml@v3.4.19
+    uses: mirceanton/reusable-workflows/.github/workflows/reusable-release-calver.yaml@f4dce998a168bbe2e53664acf4dd29407cd3d29f # v3.4.19
     secrets: inherit
diff --git a/.github/workflows/label-sync.yaml b/.github/workflows/label-sync.yaml
index 2bad862..43f56a4 100644
--- a/.github/workflows/label-sync.yaml
+++ b/.github/workflows/label-sync.yaml
@@ -31,7 +31,7 @@ on:
 
 jobs:
   label-sync:
-    uses: mirceanton/reusable-workflows/.github/workflows/reusable-label-sync.yaml@v3.4.19
+    uses: mirceanton/reusable-workflows/.github/workflows/reusable-label-sync.yaml@f4dce998a168bbe2e53664acf4dd29407cd3d29f # v3.4.19
     secrets: inherit
     with:
       dry-run: ${{ inputs.dry-run || github.event_name == 'pull_request' }}
diff --git a/.github/workflows/labeler.yaml b/.github/workflows/labeler.yaml
index 3ea3815..2e6416d 100644
--- a/.github/workflows/labeler.yaml
+++ b/.github/workflows/labeler.yaml
@@ -7,7 +7,7 @@ on:
 
 jobs:
   pr-labeler:
-    uses: mirceanton/reusable-workflows/.github/workflows/reusable-labeler.yaml@v3.4.19
+    uses: mirceanton/reusable-workflows/.github/workflows/reusable-labeler.yaml@f4dce998a168bbe2e53664acf4dd29407cd3d29f # v3.4.19
     secrets: inherit
     with:
       config-file: .github/labeler.yaml
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index 08f429e..c251cf6 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -11,23 +11,23 @@ on:
 
 jobs:
   yamllint:
-    uses: mirceanton/reusable-workflows/.github/workflows/reusable-yamllint.yaml@v3.4.19
+    uses: mirceanton/reusable-workflows/.github/workflows/reusable-yamllint.yaml@f4dce998a168bbe2e53664acf4dd29407cd3d29f # v3.4.19
     secrets: inherit
     with:
       yamllint-args: "--config-file=.yamllint.yaml"
 
   actionlint:
-    uses: mirceanton/reusable-workflows/.github/workflows/reusable-actionlint.yaml@v3.4.19
+    uses: mirceanton/reusable-workflows/.github/workflows/reusable-actionlint.yaml@f4dce998a168bbe2e53664acf4dd29407cd3d29f # v3.4.19
     secrets: inherit
 
   shellcheck:
-    uses: mirceanton/reusable-workflows/.github/workflows/reusable-shellcheck.yaml@v3.4.19
+    uses: mirceanton/reusable-workflows/.github/workflows/reusable-shellcheck.yaml@f4dce998a168bbe2e53664acf4dd29407cd3d29f # v3.4.19
     secrets: inherit
 
   markdownlint:
-    uses: mirceanton/reusable-workflows/.github/workflows/reusable-markdownlint.yaml@v3.4.19
+    uses: mirceanton/reusable-workflows/.github/workflows/reusable-markdownlint.yaml@f4dce998a168bbe2e53664acf4dd29407cd3d29f # v3.4.19
     secrets: inherit
 
   commitlint:
-    uses: mirceanton/reusable-workflows/.github/workflows/reusable-commitlint.yaml@v3.4.19
+    uses: mirceanton/reusable-workflows/.github/workflows/reusable-commitlint.yaml@f4dce998a168bbe2e53664acf4dd29407cd3d29f # v3.4.19
     secrets: inherit
diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml
index 57a10cd..54db688 100644
--- a/.github/workflows/renovate.yaml
+++ b/.github/workflows/renovate.yaml
@@ -33,7 +33,7 @@ concurrency:
 
 jobs:
   renovate:
-    uses: mirceanton/reusable-workflows/.github/workflows/reusable-renovate.yaml@v3.4.19
+    uses: mirceanton/reusable-workflows/.github/workflows/reusable-renovate.yaml@f4dce998a168bbe2e53664acf4dd29407cd3d29f # v3.4.19
     secrets: inherit
     with:
       dry-run: "${{ inputs.dry-run == true || github.event_name == 'pull_request' }}"