diff --git a/.github/workflows/ccruntime_e2e.yaml b/.github/workflows/ccruntime_e2e.yaml
index d56b616d..ed27b0d6 100644
--- a/.github/workflows/ccruntime_e2e.yaml
+++ b/.github/workflows/ccruntime_e2e.yaml
@@ -46,7 +46,7 @@ jobs:
             instance: "sev-snp"
     runs-on: ${{ matrix.instance }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
         with:
           ref: ${{ inputs.commit-hash }}
           fetch-depth: 0
diff --git a/.github/workflows/docker-publish-latest-on-merge.yaml b/.github/workflows/docker-publish-latest-on-merge.yaml
index afc026a0..ddb325ce 100644
--- a/.github/workflows/docker-publish-latest-on-merge.yaml
+++ b/.github/workflows/docker-publish-latest-on-merge.yaml
@@ -29,7 +29,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v2
diff --git a/.github/workflows/docker-publish-on-tag.yaml b/.github/workflows/docker-publish-on-tag.yaml
index e6b32206..4fe8d164 100644
--- a/.github/workflows/docker-publish-on-tag.yaml
+++ b/.github/workflows/docker-publish-on-tag.yaml
@@ -29,7 +29,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v2
diff --git a/.github/workflows/enclave-cc-cicd.yaml b/.github/workflows/enclave-cc-cicd.yaml
index 7d96af65..1baf51eb 100644
--- a/.github/workflows/enclave-cc-cicd.yaml
+++ b/.github/workflows/enclave-cc-cicd.yaml
@@ -16,7 +16,7 @@ jobs:
         ports:
           - 5000:5000
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
diff --git a/.github/workflows/enclave-cc-e2e.yaml b/.github/workflows/enclave-cc-e2e.yaml
index 33d584af..6ae52e96 100644
--- a/.github/workflows/enclave-cc-e2e.yaml
+++ b/.github/workflows/enclave-cc-e2e.yaml
@@ -18,7 +18,7 @@ jobs:
         ports:
           - 5000:5000
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
diff --git a/.github/workflows/gofmt.yaml b/.github/workflows/gofmt.yaml
index b20eb0da..920a0aa0 100644
--- a/.github/workflows/gofmt.yaml
+++ b/.github/workflows/gofmt.yaml
@@ -12,8 +12,8 @@ jobs:
     name: gofmt
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v4
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+      - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5
         with:
           go-version-file: go.mod
           check-latest: true
diff --git a/.github/workflows/golangci-lint.yaml b/.github/workflows/golangci-lint.yaml
index 68412f22..7fc59c84 100644
--- a/.github/workflows/golangci-lint.yaml
+++ b/.github/workflows/golangci-lint.yaml
@@ -12,8 +12,8 @@ jobs:
     name: lint
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v4
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+      - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5
         with:
           go-version-file: go.mod
           check-latest: true
diff --git a/.github/workflows/pre-install-image-publish-on-merge.yaml b/.github/workflows/pre-install-image-publish-on-merge.yaml
index 2d64c21a..155bc7dd 100644
--- a/.github/workflows/pre-install-image-publish-on-merge.yaml
+++ b/.github/workflows/pre-install-image-publish-on-merge.yaml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v2