diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3e96956..22fb8de 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -38,7 +38,7 @@ jobs:
           git config --global fetch.parallel 32
 
       - uses: actions/checkout@v3
-      - uses: dtolnay/rust-toolchain@master
+      - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master
         with:
           toolchain: ${{ matrix.channel }}
           components: clippy
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index e157bf7..1fdc1aa 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - id: release
-        uses: GoogleCloudPlatform/release-please-action@v3
+        uses: GoogleCloudPlatform/release-please-action@db8f2c60ee802b3748b512940dde88eabd7b7e01 # v3
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           command: manifest
@@ -44,7 +44,7 @@ jobs:
           git config --global fetch.parallel 32
 
       - uses: actions/checkout@v3
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
       - uses: Swatinem/rust-cache@v2
       - name: Install cargo plugins
         run: cargo install cargo-workspaces