diff --git a/.github/workflows/build_and_test.yml b/.github/workflows/build_and_test.yml
index 772fff49..8959a749 100644
--- a/.github/workflows/build_and_test.yml
+++ b/.github/workflows/build_and_test.yml
@@ -15,8 +15,8 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - name: "nginx 1.31.3 + OpenSSL"
-            NGINX_VERSION: "1.31.3"
+          - name: "nginx 1.31.4 + OpenSSL"
+            NGINX_VERSION: "1.31.4"
 
     services:
       redis:
@@ -44,7 +44,7 @@ jobs:
       MALLOC_PERTURB_: "9"
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Install system packages
         run: |
diff --git a/.github/workflows/semantic-pull-request.yml b/.github/workflows/semantic-pull-request.yml
index 12b87cb3..f7a470c4 100644
--- a/.github/workflows/semantic-pull-request.yml
+++ b/.github/workflows/semantic-pull-request.yml
@@ -12,7 +12,7 @@ jobs:
     name: Validate PR title
     runs-on: ubuntu-latest
     steps:
-      - uses: amannn/action-semantic-pull-request@v4
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with: