diff --git a/.github/workflows/otlp-collector-fixtures.yml b/.github/workflows/otlp-collector-fixtures.yml
index be7c3ef..8f996b8 100644
--- a/.github/workflows/otlp-collector-fixtures.yml
+++ b/.github/workflows/otlp-collector-fixtures.yml
@@ -15,9 +15,9 @@ jobs:
     runs-on: qyl-linux
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
         with:
           dotnet-version: 10.0.x
 
diff --git a/.github/workflows/smoketest.yml b/.github/workflows/smoketest.yml
index f64a4cd..ceb548f 100644
--- a/.github/workflows/smoketest.yml
+++ b/.github/workflows/smoketest.yml
@@ -18,9 +18,9 @@ jobs:
           - qyl-macos
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
         with:
           dotnet-version: 10.0.x
 
diff --git a/.github/workflows/verify-real-demos.yml b/.github/workflows/verify-real-demos.yml
index a9be10f..e8ebd06 100644
--- a/.github/workflows/verify-real-demos.yml
+++ b/.github/workflows/verify-real-demos.yml
@@ -19,9 +19,9 @@ jobs:
     runs-on: qyl-linux
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
         with:
           dotnet-version: 10.0.x
 
diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index 5fa43c6..1fb216b 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -24,9 +24,9 @@ jobs:
           - qyl-macos
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
         with:
           dotnet-version: 10.0.x
 
diff --git a/.github/workflows/webapi-aot-demo.yml b/.github/workflows/webapi-aot-demo.yml
index fc50e65..651a097 100644
--- a/.github/workflows/webapi-aot-demo.yml
+++ b/.github/workflows/webapi-aot-demo.yml
@@ -18,9 +18,9 @@ jobs:
           - qyl-macos
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
         with:
           dotnet-version: 10.0.x