diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
index f0a18cf68..8de7b4bbc 100644
--- a/.github/workflows/copilot-setup-steps.yml
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -58,10 +58,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Set up PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: "8.3"
           extensions: pdo_mysql, pdo_pgsql, pgsql, redis, xdebug
@@ -72,7 +72,7 @@ jobs:
         run: composer validate --strict
 
       - name: Cache Composer packages
-        uses: actions/cache@v4
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
         with:
           path: vendor
           key: ${{ runner.os }}-copilot-php-${{ hashFiles('**/composer.lock') }}
diff --git a/.github/workflows/php.yml b/.github/workflows/php.yml
index 6c6de39fa..186219583 100644
--- a/.github/workflows/php.yml
+++ b/.github/workflows/php.yml
@@ -47,7 +47,7 @@ jobs:
         - 6379/tcp
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
     - name: Set up PHP
       uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
@@ -152,7 +152,7 @@ jobs:
         - 6379/tcp
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       with:
           fetch-depth: 10
 
@@ -173,7 +173,7 @@ jobs:
 
     - name: Cache Composer packages
       id: composer-cache
-      uses: actions/cache@v3
+      uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
       with:
         path: vendor
         key: ${{ runner.os }}-php-${{ hashFiles('**/composer.lock') }}
@@ -282,7 +282,7 @@ jobs:
 
     - name: Upload coverage to Codecov
       if: github.event_name == 'push'
-      uses: codecov/codecov-action@v5
+      uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7
       with:
         files: ./coverage.xml
         fail_ci_if_error: false
@@ -308,7 +308,7 @@ jobs:
         - 6379/tcp
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       with:
           fetch-depth: 10
 
@@ -321,7 +321,7 @@ jobs:
         coverage: none
 
     - name: Cache Composer packages
-      uses: actions/cache@v3
+      uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
       with:
         path: vendor
         key: ${{ runner.os }}-php-${{ hashFiles('**/composer.lock') }}
@@ -442,7 +442,7 @@ jobs:
 
     - name: Upload MySQL laravel.log if tests fail
       if: ${{ github.server_url == 'https://github.com' && failure() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
       with:
         name: laravel-log-mysql
         path: vendor/orchestra/testbench-core/laravel/storage/logs/laravel.log
@@ -469,7 +469,7 @@ jobs:
         - 6379/tcp
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       with:
           fetch-depth: 10
 
@@ -482,7 +482,7 @@ jobs:
         coverage: none
 
     - name: Cache Composer packages
-      uses: actions/cache@v3
+      uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
       with:
         path: vendor
         key: ${{ runner.os }}-php-${{ hashFiles('**/composer.lock') }}
@@ -600,7 +600,7 @@ jobs:
 
     - name: Upload PostgreSQL laravel.log if tests fail
       if: ${{ github.server_url == 'https://github.com' && failure() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
       with:
         name: laravel-log-postgresql
         path: vendor/orchestra/testbench-core/laravel/storage/logs/laravel.log