diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index de6687d..61a93e9 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -26,10 +26,11 @@ jobs:
     env:
       ABVID_TEST_ENV: ${{ matrix.extra }}
     steps:
-      - uses: actions/checkout@v4
+      # Actions are pinned by commit SHA (setup-uv no longer publishes major tags).
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
           python-version: "3.11"