diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d87fa29..10dd134 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Docker with the containerd image store
-        uses: docker/setup-docker-action@v5.6.0
+        uses: docker/setup-docker-action@7ec28a010822b4626af4874f9448a4b05ac6f3e5 # v5.6.0
         with:
           set-host: true
           daemon-config: |
diff --git a/container-scan/action.yml b/container-scan/action.yml
index e7321d6..71b7929 100644
--- a/container-scan/action.yml
+++ b/container-scan/action.yml
@@ -52,7 +52,7 @@ runs:
   steps:
     - name: Enable published-image package probes on foreign platforms
       if: ${{ inputs.kind == 'published' && inputs.check-fix-availability == 'true' }}
-      uses: docker/setup-qemu-action@v4.3.0
+      uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
     - name: Scan immutable container bytes
       id: scan
       shell: bash
diff --git a/notify/action.yml b/notify/action.yml
index a07f7ce..d343e83 100644
--- a/notify/action.yml
+++ b/notify/action.yml
@@ -29,7 +29,7 @@ runs:
       id: notification-data
       if: inputs.notification-artifact != ''
       continue-on-error: true
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
       with:
         name: ${{ inputs.notification-artifact }}
         path: ${{ runner.temp }}/salty-notify-${{ github.action }}