diff --git a/.github/workflows/ruby.yml b/.github/workflows/ruby.yml
index c981835..83e4a50 100644
--- a/.github/workflows/ruby.yml
+++ b/.github/workflows/ruby.yml
@@ -22,7 +22,7 @@ jobs:
           - '3.4'
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
     - name: Set up Ruby
       uses: ruby/setup-ruby@d697be2f83c6234b20877c3b5eac7a7f342f0d0c # v1.269.0
       with:
@@ -31,7 +31,7 @@ jobs:
     - name: Run tests
       run: bundle exec rake
     - name: Upload coverage reports to Codecov
-      uses: codecov/codecov-action@v5
+      uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad  # v5
       with:
         token: ${{ secrets.CODECOV_TOKEN }}
         slug: mixpanel/mixpanel-ruby