diff --git a/.github/workflows/benchmark.yaml b/.github/workflows/benchmark.yaml
index 24f65f9..5ad4f03 100644
--- a/.github/workflows/benchmark.yaml
+++ b/.github/workflows/benchmark.yaml
@@ -39,7 +39,7 @@ jobs:
           cache: "true"
 
       - name: Setup Zig
-        uses: mlugg/setup-zig@v2
+        uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2
         with:
           version: 0.16.0
 
diff --git a/.github/workflows/bot-signoff.yaml b/.github/workflows/bot-signoff.yaml
index 4767e0e..5492093 100644
--- a/.github/workflows/bot-signoff.yaml
+++ b/.github/workflows/bot-signoff.yaml
@@ -79,7 +79,7 @@ jobs:
           cache: "true"
 
       - name: Setup Zig
-        uses: mlugg/setup-zig@v2
+        uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2
         with:
           version: 0.16.0
 
@@ -103,7 +103,7 @@ jobs:
 
       - name: Cache CI tools
         id: cache-ci-tools
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: |
             /usr/local/bin/ziglint
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 2ce1ec2..f822e05 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -78,7 +78,7 @@ jobs:
           sudo apt-get install -y libzstd-dev zlib1g-dev
 
       - name: Setup Zig
-        uses: mlugg/setup-zig@v2
+        uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2
         with:
           version: 0.16.0
 
@@ -134,7 +134,7 @@ jobs:
           brew install vectorscan zstd
 
       - name: Setup Zig
-        uses: mlugg/setup-zig@v2
+        uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2
         with:
           version: 0.16.0
 
diff --git a/charts/tero-edge/values.yaml b/charts/tero-edge/values.yaml
index e249a60..e6b1ec1 100644
--- a/charts/tero-edge/values.yaml
+++ b/charts/tero-edge/values.yaml
@@ -4,7 +4,7 @@ fullnameOverride: ""
 image:
   repository: ghcr.io/usetero/edge
   pullPolicy: IfNotPresent
-  tag: ""
+  tag: "@sha256:2c89db3452c2ce1e0ca701a2a817a2c8703be64c1452b6f07f3bc80af2ccef00"
 imagePullSecrets: []
 
 serviceAccount: