diff --git a/.github/workflows/release.yml.template b/.github/workflows/release.yml.template
index 4254324..c6464b7 100644
--- a/.github/workflows/release.yml.template
+++ b/.github/workflows/release.yml.template
@@ -32,11 +32,11 @@ jobs:
           - target: aarch64-apple-darwin
             os: macos-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
       - uses: dtolnay/rust-toolchain@stable
         with:
           targets: ${{ matrix.target }}
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@v2.9.2
       - name: install musl toolchain
         if: matrix.target == 'x86_64-unknown-linux-musl'
         run: sudo apt-get install -y musl-tools
@@ -66,7 +66,7 @@ jobs:
           $pkg = "target/${{ matrix.target }}/release"
           Compress-Archive -Path "$pkg/$env:BIN_NAME.exe" `
             -DestinationPath "dist/$env:BIN_NAME-${{ matrix.target }}.zip"
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@v7.0.1
         with:
           name: ${{ env.BIN_NAME }}-${{ matrix.target }}
           path: dist/*
@@ -77,11 +77,11 @@ jobs:
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/')
     steps:
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@v8.0.1
         with:
           path: dist
           merge-multiple: true
-      - uses: softprops/action-gh-release@v3
+      - uses: softprops/action-gh-release@v3.0.3
         with:
           files: dist/*
           generate_release_notes: true
@@ -92,7 +92,7 @@ jobs:
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/')
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
       - uses: dtolnay/rust-toolchain@stable
       # --locked keeps the committed Cargo.lock so the publish
       # verification step cannot fail the dirty-git-state check by