diff --git a/.github/workflows/develop.yml b/.github/workflows/develop.yml
index ac11db39..487626e7 100644
--- a/.github/workflows/develop.yml
+++ b/.github/workflows/develop.yml
@@ -17,10 +17,10 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
       - name: setup node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
         with:
           node-version: ${{ matrix.node }}
           cache: "npm"
@@ -36,7 +36,7 @@ jobs:
 
       # Set the credentials from repository settings/secrets
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v2
+        uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 # v2.2.0
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -55,7 +55,7 @@ jobs:
 
       # Invalidate Cloudfront (this action)
       - name: invalidate
-        uses: chaitanyapotti/cloudfront-update-distribution@v2
+        uses: chaitanyapotti/cloudfront-update-distribution@23ab09ab2414fcb8c1e69b7416c17340507007b1 # v2
         with:
           cloudfront-distribution-id: ${{ secrets.DISTRIBUTION_BETA }}
           cloudfront-invalidation-path: "/*"
diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml
index 0b1c126a..fc092223 100644
--- a/.github/workflows/master.yml
+++ b/.github/workflows/master.yml
@@ -17,10 +17,10 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
       - name: setup node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
         with:
           node-version: ${{ matrix.node }}
           cache: "npm"
@@ -36,7 +36,7 @@ jobs:
 
       # Set the credentials from repository settings/secrets
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v2
+        uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 # v2.2.0
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -54,7 +54,7 @@ jobs:
 
       # Invalidate Cloudfront (this action)
       - name: invalidate
-        uses: chaitanyapotti/cloudfront-update-distribution@v2
+        uses: chaitanyapotti/cloudfront-update-distribution@23ab09ab2414fcb8c1e69b7416c17340507007b1 # v2
         with:
           cloudfront-distribution-id: ${{ secrets.DISTRIBUTION_PROD }}
           cloudfront-invalidation-path: "/*"
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 5597ccf9..67a6b070 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -17,10 +17,10 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
       - name: setup node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
         with:
           node-version: ${{ matrix.node }}
           cache: "npm"