diff --git a/.github/workflows/aws_integration_test.yml b/.github/workflows/aws_integration_test.yml
index 451fddf2..b18eced5 100644
--- a/.github/workflows/aws_integration_test.yml
+++ b/.github/workflows/aws_integration_test.yml
@@ -21,7 +21,7 @@ jobs:
     continue-on-error: true
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
diff --git a/.github/workflows/aws_lint.yml b/.github/workflows/aws_lint.yml
index 1c307773..98052b69 100644
--- a/.github/workflows/aws_lint.yml
+++ b/.github/workflows/aws_lint.yml
@@ -7,9 +7,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       - name: Setup Python
-        uses: actions/setup-python@v3
+        uses: actions/setup-python@3542bca2639a428e1796aaa6a2ffef0c0f575566 # v3.1.4
         with:
           python-version: "3.13"
 
diff --git a/.github/workflows/aws_unit_test.yml b/.github/workflows/aws_unit_test.yml
index 2f9556a7..37caa622 100644
--- a/.github/workflows/aws_unit_test.yml
+++ b/.github/workflows/aws_unit_test.yml
@@ -7,9 +7,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       - name: Setup Python 3.13
-        uses: actions/setup-python@v3
+        uses: actions/setup-python@3542bca2639a428e1796aaa6a2ffef0c0f575566 # v3.1.4
         with:
           python-version: 3.13
 
diff --git a/.github/workflows/azure_tests.yml b/.github/workflows/azure_tests.yml
index 03e03ca4..2d03d82e 100644
--- a/.github/workflows/azure_tests.yml
+++ b/.github/workflows/azure_tests.yml
@@ -6,9 +6,9 @@ jobs:
     build:
       runs-on: ubuntu-latest
       steps:
-        - uses: actions/checkout@v4
+        - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         - name: Use Node.js
-          uses: actions/setup-node@v3
+          uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
           with:
             node-version: '20.x'
         - run: npm install
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index cb11ca7e..d8ee7463 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -39,11 +39,11 @@ jobs:
 
     steps:
     - name: Checkout source
-      uses: actions/checkout@v3
+      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2.28.1
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -54,7 +54,7 @@ jobs:
     # Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below).
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
+      uses: github/codeql-action/autobuild@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2.28.1
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -68,4 +68,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2.28.1
diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml
index f5fb5ea0..e98f0e08 100644
--- a/.github/workflows/pr.yaml
+++ b/.github/workflows/pr.yaml
@@ -8,6 +8,6 @@ jobs:
         pull-requests: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/labeler@v4
+    - uses: actions/labeler@ac9175f8a1f3625fd0d4fb234536d26811351594 # v4.3.0
       with:
         repo-token: "${{ secrets.GITHUB_TOKEN }}"
diff --git a/.github/workflows/trace_forwarder.yml b/.github/workflows/trace_forwarder.yml
index fd2b856d..a697bfb4 100644
--- a/.github/workflows/trace_forwarder.yml
+++ b/.github/workflows/trace_forwarder.yml
@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     steps:
       - name: Checkout source
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       - name: Run trace forwarder tests
         run: |
           ./aws/logs_monitoring/trace_forwarder/scripts/run_tests.sh