diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
index a5a803d..59e88e5 100644
--- a/.github/workflows/codeql.yaml
+++ b/.github/workflows/codeql.yaml
@@ -29,7 +29,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
diff --git a/.github/workflows/gerrit-verify.yaml b/.github/workflows/gerrit-verify.yaml
index ec298e9..2d493c3 100644
--- a/.github/workflows/gerrit-verify.yaml
+++ b/.github/workflows/gerrit-verify.yaml
@@ -53,7 +53,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Clear votes
-        uses: lfit/gerrit-review-action@v0.3
+        # yamllint disable-line rule:line-length
+        uses: lfit/gerrit-review-action@b2e3ea69fb74183ac3d32360d06b2b085c2efee6  # v0.5
         with:
           host: ${{ vars.LFIT_GERRIT_SERVER }}
           username: ${{ vars.LFIT_GERRIT_SSH_USER }}
@@ -69,7 +70,9 @@ jobs:
     needs: clear-vote
     runs-on: ubuntu-latest
     steps:
-      - uses: lfit/checkout-gerrit-change-action@v0.3
+      - name: Checkout change
+        # yamllint disable-line rule:line-length
+        uses: lfit/checkout-gerrit-change-action@95c493e8fd60233fac7b9c99ebe5f60e9a8c555b  # @v0.7
         with:
           gerrit-refspec: ${{ inputs.GERRIT_REFSPEC }}
           delay: "0s"
@@ -88,7 +91,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout change
-        uses: lfit/checkout-gerrit-change-action@v0.3
+        # yamllint disable-line rule:line-length
+        uses: lfit/checkout-gerrit-change-action@95c493e8fd60233fac7b9c99ebe5f60e9a8c555b  # v0.7
         with:
           gerrit-refspec: ${{ inputs.GERRIT_REFSPEC }}
           delay: "0s"
@@ -105,7 +109,9 @@ jobs:
     outputs:
       wheel-distribution: ${{ steps.wheel-distribution.outputs.path }}
     steps:
-      - uses: lfit/checkout-gerrit-change-action@v0.3
+      - name: Checkout change
+        # yamllint disable-line rule:line-length
+        uses: lfit/checkout-gerrit-change-action@95c493e8fd60233fac7b9c99ebe5f60e9a8c555b  # v0.7
         with:
           gerrit-refspec: ${{ inputs.GERRIT_REFSPEC }}
       - uses: actions/setup-python@v4
@@ -136,7 +142,9 @@ jobs:
           - ubuntu-latest
     runs-on: ${{ matrix.platform }}
     steps:
-      - uses: lfit/checkout-gerrit-change-action@v0.3
+      - name: Checkout change
+        # yamllint disable-line rule:line-length
+        uses: lfit/checkout-gerrit-change-action@95c493e8fd60233fac7b9c99ebe5f60e9a8c555b  # v0.7
         with:
           gerrit-refspec: ${{ inputs.GERRIT_REFSPEC }}
           delay: "0s"
@@ -172,7 +180,8 @@ jobs:
 
     steps:
       - name: Checkout change
-        uses: lfit/checkout-gerrit-change-action@v0.3
+        # yamllint disable-line rule:line-length
+        uses: lfit/checkout-gerrit-change-action@95c493e8fd60233fac7b9c99ebe5f60e9a8c555b  # v0.7
         with:
           gerrit-refspec: ${{ inputs.GERRIT_REFSPEC }}
           delay: "0s"
@@ -204,7 +213,8 @@ jobs:
     steps:
       - uses: technote-space/workflow-conclusion-action@v3
       - name: Set vote
-        uses: lfit/gerrit-review-action@v0.3
+        # yamllint disable-line rule:line-length
+        uses: lfit/gerrit-review-action@b2e3ea69fb74183ac3d32360d06b2b085c2efee6  # v0.5
         with:
           host: ${{ vars.LFIT_GERRIT_SERVER }}
           username: ${{ vars.LFIT_GERRIT_SSH_USER }}
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 4fa3370..c0561f7 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -12,7 +12,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: Configure Python
         uses: actions/setup-python@v4
         with: