diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dda726c..1742923 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,13 +11,13 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2
     - uses: olafurpg/setup-scala@v11
       with:
         java-version: openjdk@1.11
 
     - name: Cache Coursier dependencies
-      uses: actions/cache@v1
+      uses: actions/cache@f5ce41475b483ad7581884324a6eca9f48f8dcc7 # v1
       with:
        path: ~/.cache/coursier
        key: ${{ runner.os }}-${{ github.ref }}-coursier
@@ -25,7 +25,7 @@ jobs:
         ${{ runner.os }}-${{ github.ref }}-coursier
 
     - name: Cache Ivy dependencies
-      uses: actions/cache@v1
+      uses: actions/cache@f5ce41475b483ad7581884324a6eca9f48f8dcc7 # v1
       with:
         path: ~/.ivy2/cache
         key: ${{ runner.os }}-${{ github.ref }}-ivy2
diff --git a/.github/workflows/label_and_automerge.yaml b/.github/workflows/label_and_automerge.yaml
index 0d216a2..5ee6ced 100644
--- a/.github/workflows/label_and_automerge.yaml
+++ b/.github/workflows/label_and_automerge.yaml
@@ -30,7 +30,7 @@ jobs:
   pr-labeler:
     runs-on: ubuntu-latest
     steps:
-      - uses: TimonVS/pr-labeler-action@v3
+      - uses: TimonVS/pr-labeler-action@bd0b592a410983316a454e3d48444608f028ec8e # v3
         with:
           configuration-path: .github/pr-labeler.yml # optional, .github/pr-labeler.yml is the default value
         env:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c4e5a92..c646301 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,7 +7,7 @@ jobs:
   publish:
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@v3.0.2
+      - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # v3.0.2
         with:
           fetch-depth: 0
       - uses: olafurpg/setup-scala@v13