diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c575c46..6f1b30c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
       - run: cargo build --release
       # Child-process lifecycle: nothing aegis starts (judge server, model
       # download) may outlive it. Must pass.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b1f9454..aba2934 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -33,7 +33,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
         with:
           targets: ${{ matrix.target }}
       - name: Install musl/cross tools (Linux)
@@ -52,7 +52,7 @@ jobs:
       - name: Rename artifact
         run: cp target/${{ matrix.target }}/release/aegis ${{ matrix.name }}
       - name: Upload to release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
         with:
           files: ${{ matrix.name }}
           fail_on_unmatched_files: true