diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1f62a1d4d9..a66d12223f 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -16,12 +16,12 @@ jobs:
       contents: write
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           token: ${{ secrets.USERSTYLES_TOKEN }}
 
       - name: Setup Deno
-        uses: nekowinston/setup-deno@main
+        uses: nekowinston/setup-deno@a790e9ad1e6b1c727a4ea621a8a8219b1f2c373d # main
         with:
           deno-version: v2.3.5
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1ac3221f09..69372958d4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,13 +15,13 @@ jobs:
     # Prevent infinite loops by checking if the last commit was autogenerated.
     if: ${{ github.repository == 'catppuccin/userstyles' && github.event.commits[0].author.name != 'github-actions' }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           token: ${{ secrets.USERSTYLES_TOKEN }}
           fetch-depth: 2
 
       - name: Setup Deno
-        uses: nekowinston/setup-deno@main
+        uses: nekowinston/setup-deno@a790e9ad1e6b1c727a4ea621a8a8219b1f2c373d # main
         with:
           deno-version: v2.3.5
 
@@ -30,7 +30,7 @@ jobs:
           git diff --name-only HEAD^1 HEAD | grep '^styles/.*catppuccin\.user\.less$' | xargs deno task ci:bump
 
       - name: Commit changes
-        uses: EndBug/add-and-commit@v9
+        uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9
         with:
           message: "chore: bump changed userstyles"
           default_author: github_actions
@@ -42,7 +42,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.USERSTYLES_TOKEN }}
 
       - name: Commit changes
-        uses: EndBug/add-and-commit@v9
+        uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9
         with:
           message: "chore: update generated files"
           default_author: github_actions
@@ -52,7 +52,7 @@ jobs:
         run: deno fmt
 
       - name: Commit changes
-        uses: EndBug/add-and-commit@v9
+        uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9
         with:
           message: "style: deno fmt"
           default_author: github_actions
diff --git a/.github/workflows/deno-check.yml b/.github/workflows/deno-check.yml
index fab09078df..363478ff5d 100644
--- a/.github/workflows/deno-check.yml
+++ b/.github/workflows/deno-check.yml
@@ -14,10 +14,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Setup Deno
-        uses: nekowinston/setup-deno@main
+        uses: nekowinston/setup-deno@a790e9ad1e6b1c727a4ea621a8a8219b1f2c373d # main
         with:
           deno-version: v2.3.5
 
diff --git a/.github/workflows/deno-lock.yml b/.github/workflows/deno-lock.yml
index d4772b37a5..6cb3ebeaf6 100644
--- a/.github/workflows/deno-lock.yml
+++ b/.github/workflows/deno-lock.yml
@@ -11,12 +11,12 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           ref: ${{ github.event.pull_request.head.ref }}
 
       - name: Setup Deno
-        uses: nekowinston/setup-deno@main
+        uses: nekowinston/setup-deno@a790e9ad1e6b1c727a4ea621a8a8219b1f2c373d # main
         with:
           deno-version: v2.3.5
 
@@ -24,7 +24,7 @@ jobs:
         run: deno cache **/*.ts --lock=deno.lock
 
       - name: Commit & push changes
-        uses: EndBug/add-and-commit@v9
+        uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9
         with:
           message: "chore: regenerate `deno.lock`"
           default_author: github_actions
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 1c529260de..fd1d29adb7 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -16,9 +16,9 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - name: Build & Upload Site
-        uses: withastro/action@v4
+        uses: withastro/action@a4407e937037e68022f04ae1c068d3634f08bc8d # v4
         with:
           path: ./docs
           package-manager: pnpm@10.14.0
@@ -32,4 +32,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
diff --git a/.github/workflows/issues.yml b/.github/workflows/issues.yml
index 20cb94ca01..1746b21619 100644
--- a/.github/workflows/issues.yml
+++ b/.github/workflows/issues.yml
@@ -11,7 +11,7 @@ jobs:
 
     steps:
       - name: Add issue labels
-        uses: github/issue-labeler@v3.4
+        uses: github/issue-labeler@c1b0f9f52a63158c4adc09425e858e87b32e9685 # v3.4
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"
           configuration-path: .github/issue-labeler.yml
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index c032d9bc0f..27ade55f60 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -14,10 +14,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Setup Deno
-        uses: nekowinston/setup-deno@main
+        uses: nekowinston/setup-deno@a790e9ad1e6b1c727a4ea621a8a8219b1f2c373d # main
         with:
           deno-version: v2.3.5
 
diff --git a/.github/workflows/maintainers.yml b/.github/workflows/maintainers.yml
index c7f349002f..16fb6e5658 100644
--- a/.github/workflows/maintainers.yml
+++ b/.github/workflows/maintainers.yml
@@ -12,10 +12,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Setup Deno
-        uses: nekowinston/setup-deno@main
+        uses: nekowinston/setup-deno@a790e9ad1e6b1c727a4ea621a8a8219b1f2c373d # main
         with:
           deno-version: v2.3.5
 
diff --git a/.github/workflows/pull-requests.yml b/.github/workflows/pull-requests.yml
index c5150b1c45..7595e5db74 100644
--- a/.github/workflows/pull-requests.yml
+++ b/.github/workflows/pull-requests.yml
@@ -9,10 +9,10 @@ jobs:
     if: ${{ !contains(github.event.pull_request.title, '(tree-wide)') && !contains(github.event.pull_request.title, '(treewide)') }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Add pull request labels
-        uses: actions/labeler@v4.3.0
+        uses: actions/labeler@ac9175f8a1f3625fd0d4fb234536d26811351594 # v4.3.0
         with:
           configuration-path: .github/pr-labeler.yml
           sync-labels: true