diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index cd4bc75..c88af98 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -17,8 +17,8 @@ jobs:
     outputs:
       images: ${{ steps.find.outputs.images }}
     steps:
-      - uses: actions/checkout@v5
-      
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
       - name: Find image directories
         id: find
         run: |
@@ -40,9 +40,9 @@ jobs:
         images: ${{ fromJson(needs.find.outputs.images) }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: docker/setup-qemu-action@v3
-      - uses: docker/setup-buildx-action@v3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
       # - uses: aws-actions/configure-aws-credentials@v5
       #   with:
       #     role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
@@ -50,13 +50,13 @@ jobs:
       # - uses: aws-actions/amazon-ecr-login@v2
       #   with:
       #     registry-type: public
-      - uses: docker/login-action@v3
+      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ${{ env.GHCR_REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - id: metadata
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
         with:
           # ${{ env.ECR_REGISTRY }}/database-toolbox/${{ matrix.images.dir }}
           images: |
@@ -73,7 +73,7 @@ jobs:
             org.opencontainers.image.source=${{ github.repository }}
       
       - name: Build and push to staging ECR
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: ./images/${{ matrix.images.dir }}
           file: ./images/${{ matrix.images.dir }}/Dockerfile