diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml
index efbedad..7602419 100644
--- a/.github/workflows/android.yml
+++ b/.github/workflows/android.yml
@@ -16,12 +16,12 @@ jobs:
 
     steps:
       - name: Check out code
-        uses: actions/checkout@v3
-      - uses: actions/setup-go@v5
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
         with:
           go-version-file: "go.mod"
       - name: Switch to Java 17 # Note: 17 is pre-installed on ubuntu-latest
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
         with:
           distribution: "temurin"
           java-version: "17"
diff --git a/.github/workflows/go_mod_tidy.yml b/.github/workflows/go_mod_tidy.yml
index d6c1dac..f207d83 100644
--- a/.github/workflows/go_mod_tidy.yml
+++ b/.github/workflows/go_mod_tidy.yml
@@ -19,10 +19,10 @@ jobs:
 
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
         with:
           cache: false
           go-version-file: go.mod
diff --git a/.github/workflows/license-headers.yml b/.github/workflows/license-headers.yml
index 2a78455..5f4f7b5 100644
--- a/.github/workflows/license-headers.yml
+++ b/.github/workflows/license-headers.yml
@@ -14,6 +14,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: check license headers
         run: ./scripts/check_license_headers.sh .