diff --git a/.github/workflows/generate-release.yml b/.github/workflows/generate-release.yml
index eca774709b8..77bdbae1eb0 100644
--- a/.github/workflows/generate-release.yml
+++ b/.github/workflows/generate-release.yml
@@ -46,7 +46,7 @@ jobs:
 
     steps:
       - name: Checkout lass 500 commits (fot <commits> to work)
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           fetch-depth: 500
 
@@ -66,7 +66,7 @@ jobs:
           echo "tag=${TAG}" >> $GITHUB_OUTPUT
 
       - name: Create Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@e7a8f85e1c67a31e6ed99a94b41bd0b71bbee6b8 # v2
         with:
           name: ${{ steps.generate-release-text.outputs.title }}
           tag_name: ${{ steps.generate-release-text.outputs.tag }}
diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml
index 6fbfac31928..d0f98647680 100644
--- a/.github/workflows/reusable-build.yml
+++ b/.github/workflows/reusable-build.yml
@@ -304,7 +304,7 @@ jobs:
 
       - name: Rechunk Image
         id: rechunk
-        uses: hhd-dev/rechunk@v1.0.1
+        uses: hhd-dev/rechunk@602e6d62558ab23e15e8764ce06e26c0f328da71 # v1.0.1
         with:
           rechunk: ghcr.io/hhd-dev/rechunk:v1.0.1
           ref: "raw-img"