diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fd72e10..db57556 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -35,7 +35,7 @@ jobs:
         run: go test -race -coverprofile=coverage.out -covermode=atomic ./...
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v7
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7
         with:
           files: ./trustedagents/coverage.out
           flags: unittests
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index a1cdc56..4007ab1 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -73,7 +73,7 @@ jobs:
           go-version-file: go.mod
           cache: true
       - name: Run gosec
-        uses: securego/gosec@master
+        uses: securego/gosec@71577268350e1e0f2f1491de1ef53f1227b43c1f # master
         with:
           # SARIF for the Security tab; fail the job on any finding.
           # No rules are globally disabled — the package currently has