diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a0447d62..71999dc7 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -34,10 +34,10 @@ jobs:
 
         steps:
             -   name: Checkout
-                uses: actions/checkout@v7
+                uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
             -   name: Set up cache for ~./m2/repository
-                uses: actions/cache@v6
+                uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
                 with:
                     path: ~/.m2/repository
                     key: maven-${{ matrix.os }}-java${{ matrix.java }}-${{ hashFiles('**/pom.xml') }}-${{ hashFiles('.mvn/wrapper/maven-wrapper.properties') }}
@@ -46,7 +46,7 @@ jobs:
                         maven-${{ matrix.os }}-
 
             -   name: Set up JDK
-                uses: actions/setup-java@v5
+                uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
                 with:
                     java-version: ${{ matrix.java }}
                     distribution: "adopt"
@@ -55,7 +55,7 @@ jobs:
                 run: ./mvnw --batch-mode clean install
 
             -   name: Publish Test Report
-                uses: mikepenz/action-junit-report@v6
+                uses: mikepenz/action-junit-report@a9170d5795813c01ab4901ffb045b52bab4ab09d # v6
                 if: success() || failure() # always run even if the previous step fails
                 with:
                     report_paths: '**/target/*/TEST-*.xml'
@@ -71,7 +71,7 @@ jobs:
             - build
         steps:
             -   name: Check out
-                uses: actions/checkout@v7
+                uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
                 with:
                     fetch-depth: 0
             -   run: exit 1
diff --git a/.github/workflows/jenkins-security-scan.yml b/.github/workflows/jenkins-security-scan.yml
index 5976f9f6..54968af5 100644
--- a/.github/workflows/jenkins-security-scan.yml
+++ b/.github/workflows/jenkins-security-scan.yml
@@ -15,7 +15,7 @@ permissions:
 
 jobs:
   security-scan:
-    uses: jenkins-infra/jenkins-security-scan/.github/workflows/jenkins-security-scan.yaml@v2
+    uses: jenkins-infra/jenkins-security-scan/.github/workflows/jenkins-security-scan.yaml@da7438f10fecc21e40174d420ef34daae0874122 # v2
     with:
       java-cache: 'maven' # Optionally enable use of a build dependency cache. Specify 'maven' or 'gradle' as appropriate.
       # java-version: 21 # Optionally specify what version of Java to set up for the build, or remove to use a recent default.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4d65ad92..ed618b31 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -22,7 +22,7 @@ jobs:
 
         steps:
             -   name: Check out
-                uses: actions/checkout@v7
+                uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
                 with:
                     fetch-depth: 0
 
@@ -34,14 +34,14 @@ jobs:
                     git config --global user.name "$(gh api /users/${GITHUB_ACTOR} | jq .name -r)"
 
             -   name: Set up JDK
-                uses: actions/setup-java@v5
+                uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
                 with:
                     distribution: 'adopt'
                     java-version: 25
                     cache: 'maven'
 
             -   name: Setup settings.xml
-                uses: s4u/maven-settings-action@v4.0.0
+                uses: s4u/maven-settings-action@894661b3ddae382f1ae8edbeab60987e08cf0788 # v4.0.0
                 with:
                     override: true
                     servers: |
@@ -77,7 +77,7 @@ jobs:
 
             -   name: Conventional Changelog Action
                 id: create-changelog
-                uses: TriPSs/conventional-changelog-action@v6
+                uses: TriPSs/conventional-changelog-action@ee43def3241429afddab215ba89090cbf64fb45c # v6
                 with:
                     input-file: CHANGELOG.md
                     github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -90,7 +90,7 @@ jobs:
 
             -   name: tag-and-release
                 id: tag-and-release
-                uses: avakar/tag-and-release@v1.0.0
+                uses: avakar/tag-and-release@8f4b627f03fe59381267d3925d39191e27f44236 # v1.0.0
                 with:
                     release_name: ${{ github.event.inputs.releaseversion }}
                     tag_name: v${{ github.event.inputs.releaseversion }}
@@ -100,7 +100,7 @@ jobs:
 
             -   name: Create Pull Request
                 id: create-pr
-                uses: peter-evans/create-pull-request@v8
+                uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
                 with:
                     commit-message: Update report
                     committer: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>