diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 249ba4e327..e94fd11087 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -42,7 +42,7 @@ jobs:
               env:
                   GH_TOKEN: ${{ github.token }}
 
-            - uses: gacts/install-dnscontrol@v1
+            - uses: gacts/install-dnscontrol@890ba3249712c51203ccb7aba63307c0091e921b # v1.3.4
               if: github.event_name == 'pull_request' && contains(fromJson(env.CHANGED_FILES), 'dnsconfig.js')
               with:
                   version: 4.14.0
diff --git a/.github/workflows/dnscontrol.yml b/.github/workflows/dnscontrol.yml
index 28764d72bc..fff7441063 100644
--- a/.github/workflows/dnscontrol.yml
+++ b/.github/workflows/dnscontrol.yml
@@ -19,7 +19,7 @@ jobs:
         steps:
             - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
-            - uses: gacts/install-dnscontrol@v1
+            - uses: gacts/install-dnscontrol@890ba3249712c51203ccb7aba63307c0091e921b # v1.3.4
               with:
                   version: 4.14.0
 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index b82a3730da..0e0081810b 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -21,7 +21,7 @@ jobs:
         steps:
             - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
-            - uses: gacts/install-dnscontrol@v1
+            - uses: gacts/install-dnscontrol@890ba3249712c51203ccb7aba63307c0091e921b # v1.3.4
               with:
                   version: 4.14.0
 
diff --git a/.github/workflows/raw-api.yml b/.github/workflows/raw-api.yml
index 4d145641e1..058e3b4645 100644
--- a/.github/workflows/raw-api.yml
+++ b/.github/workflows/raw-api.yml
@@ -34,7 +34,7 @@ jobs:
               run: echo "raw.is-a.dev" > raw-api/CNAME
 
             - name: Commit
-              uses: cpina/github-action-push-to-another-repository@main
+              uses: cpina/github-action-push-to-another-repository@55306faa4ed53b815ae49e564af8cfb359d32ae2 # v1.7.3
               with:
                   source-directory: "raw-api"
                   destination-github-username: is-a-dev