diff --git a/.github/workflows/blueprint.yml b/.github/workflows/blueprint.yml
index 8e0c43f5..d334aaff 100644
--- a/.github/workflows/blueprint.yml
+++ b/.github/workflows/blueprint.yml
@@ -21,7 +21,7 @@ jobs:
     name: Build project
     steps:
       - name: Checkout project
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
 
@@ -35,7 +35,7 @@ jobs:
         run: ~/.elan/bin/lake build SphereEversion
 
       - name: Cache API docs
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: |
             docbuild/.lake/build/doc/Aesop
@@ -49,7 +49,7 @@ jobs:
           key: Docs-${{ hashFiles('lake-manifest.json') }}
 
       - name: Build blueprint and copy to `docs/blueprint`
-        uses: xu-cheng/texlive-action@v2
+        uses: xu-cheng/texlive-action@f886de8159e5952a131848a5fa9c3196a2132b5d # v2
         with:
           docker_image: ghcr.io/xu-cheng/texlive-full:20231201
           run: |
@@ -90,14 +90,14 @@ jobs:
 
       - name: Upload docs & blueprint artifact
         if: github.event_name == 'push'
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
         with:
           path: docs/
 
       - name: Deploy to GitHub Pages
         if: github.event_name == 'push'
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
 
       # - name: Make sure the cache works
       #   run: mv docs/docs .lake/build/doc