diff --git a/.github/actions/agentskit-evals/action.yml b/.github/actions/agentskit-evals/action.yml
index f03a40d4f..80d6b677e 100644
--- a/.github/actions/agentskit-evals/action.yml
+++ b/.github/actions/agentskit-evals/action.yml
@@ -31,13 +31,13 @@ runs:
   using: 'composite'
   steps:
     - name: Setup Node
-      uses: actions/setup-node@v6
+      uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
       with:
         node-version: ${{ inputs.node-version }}
 
     - name: Install pnpm
       if: ${{ inputs.package-manager == 'pnpm' }}
-      uses: pnpm/action-setup@v4
+      uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
 
     - name: Install deps (pnpm)
       if: ${{ inputs.package-manager == 'pnpm' }}
@@ -63,7 +63,7 @@ runs:
 
     - name: Upload report artifacts
       if: ${{ inputs.upload-artifact == 'true' && always() }}
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
       with:
         name: agentskit-evals
         path: ${{ inputs.out-dir }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 169b60f7c..17ab26cd9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -202,7 +202,7 @@ jobs:
     runs-on: ubuntu-latest
     services:
       postgres:
-        image: postgres:16
+        image: postgres:16@sha256:9e2cf6287f25c3151f4c9421ccce2b17f3e60061c111a29165e0d2cdd9ff0a97
         env:
           POSTGRES_HOST_AUTH_METHOD: trust
         ports: