diff --git a/.github/workflows/publish_to_npm.yaml b/.github/workflows/publish_to_npm.yaml
index 8ac1e45a1..126e1fd2e 100644
--- a/.github/workflows/publish_to_npm.yaml
+++ b/.github/workflows/publish_to_npm.yaml
@@ -17,14 +17,14 @@ jobs:
         name: Publish to NPM
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@v6
+            - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
               with:
                   ref: ${{ inputs.ref }}
                   token: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }}
                   fetch-depth: 0 # we need to pull everything to allow lerna to detect what packages changed
 
             - name: Use Node.js 24
-              uses: actions/setup-node@v6
+              uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
               with:
                   node-version: 24
                   registry-url: 'https://registry.npmjs.org'
diff --git a/.github/workflows/test_and_release.yaml b/.github/workflows/test_and_release.yaml
index 1c30bfc4f..872a1571c 100644
--- a/.github/workflows/test_and_release.yaml
+++ b/.github/workflows/test_and_release.yaml
@@ -18,9 +18,9 @@ jobs:
                 node-version: [ 20, 22, 24 ]
 
         steps:
-            -   uses: actions/checkout@v6
+            -   uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
             -   name: Use Node.js ${{ matrix.node-version }}
-                uses: actions/setup-node@v6
+                uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
                 with:
                     node-version: ${{ matrix.node-version }}
             -   name: Install pnpm and dependencies
@@ -33,9 +33,9 @@ jobs:
         runs-on: ubuntu-latest
 
         steps:
-            -   uses: actions/checkout@v6
+            -   uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
             -   name: Use Node.js 24
-                uses: actions/setup-node@v6
+                uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
                 with:
                     node-version: 24
             -   name: Install pnpm and dependencies
@@ -54,9 +54,9 @@ jobs:
         runs-on: ubuntu-latest
 
         steps:
-            -   uses: actions/checkout@v6
+            -   uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
             -   name: Use Node.js 24
-                uses: actions/setup-node@v6
+                uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
                 with:
                     node-version: 24
             -   name: Install pnpm and dependencies
@@ -68,9 +68,9 @@ jobs:
         runs-on: ubuntu-latest
 
         steps:
-            -   uses: actions/checkout@v6
+            -   uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
             -   name: Use Node.js 24
-                uses: actions/setup-node@v6
+                uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
                 with:
                     node-version: 24
             -   name: Install pnpm and dependencies
@@ -83,10 +83,10 @@ jobs:
         needs: [ test, build, lint, format-check ]
         runs-on: ubuntu-latest
         steps:
-            -   uses: actions/checkout@v6
+            -   uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
                 with:
                     fetch-depth: 0 # we need to pull everything to allow lerna to detect what packages changed
-            -   uses: actions/setup-node@v6
+            -   uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
                 with:
                     node-version: 24
             -   name: Install pnpm and dependencies