diff --git a/.github/workflows/testnet-build.yml b/.github/workflows/testnet-build.yml
index ec557c0e1..ca5e1d319 100644
--- a/.github/workflows/testnet-build.yml
+++ b/.github/workflows/testnet-build.yml
@@ -17,12 +17,14 @@ jobs:
     # 1 - checkout project and dependencies
 
     - name: Checkout Phoenix
-      uses: actions/checkout@v2
+      # v2.7.0
+      uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5
       with:
         path: phoenix
 
     - name: Checkout lightning-kmp
-      uses: actions/checkout@v2
+      # v2.7.0
+      uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5
       with:
         repository: ACINQ/lightning-kmp
         ref: master
@@ -31,14 +33,16 @@ jobs:
     # 2 - setup cache/jdk
 
     - name: Cached Konan
-      uses: actions/cache@v4
+      # v4.3.0
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830
       with:
         path: ~/.konan
         key: ${{ runner.os }}-konan-${{ hashFiles('**/*.gradle*') }}-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties') }}
         restore-keys: ${{ runner.os }}-konan-
 
     - name: Set up jdk 1.17
-      uses: actions/setup-java@v1
+      # v1.4.4
+      uses: actions/setup-java@b6e674f4b717d7b0ae3baee0fbe79f498905dfde
       with:
         java-version: 17
 
@@ -78,7 +82,8 @@ jobs:
       # 5 - upload apk
 
     - name: Upload apk as artifact for this action
-      uses: actions/upload-artifact@v4
+      # v4.6.2
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
       with:
         name: phoenix-testnet
         path: upload/phoenix-testnet-latest.apk