diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 6e84964..1fc0564 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -13,9 +13,11 @@ jobs:
     runs-on: ubuntu-latest
     name: Formatting
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
 
-      - uses: actions/setup-node@v2
+      - uses: actions/setup-node@1f8c6b94b26d0feae1e387ca63ccbdc44d27b561 # v2
         with:
           node-version: "20"
 
@@ -27,9 +29,11 @@ jobs:
     runs-on: ubuntu-latest
     name: Typechecks
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
 
-      - uses: actions/setup-node@v2
+      - uses: actions/setup-node@1f8c6b94b26d0feae1e387ca63ccbdc44d27b561 # v2
         with:
           node-version: "20"
 
@@ -41,9 +45,11 @@ jobs:
     runs-on: ubuntu-latest
     name: E2E on Chrome
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
 
-      - uses: cypress-io/github-action@v6
+      - uses: cypress-io/github-action@f790eee7a50d9505912f50c2095510be7de06aa7 # v6
         with:
           browser: chrome
 
@@ -51,9 +57,11 @@ jobs:
     runs-on: ubuntu-latest
     name: E2E on Firefox
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
 
-      - uses: cypress-io/github-action@v6
+      - uses: cypress-io/github-action@f790eee7a50d9505912f50c2095510be7de06aa7 # v6
         with:
           browser: firefox
 
@@ -61,9 +69,11 @@ jobs:
     runs-on: windows-latest
     name: E2E on Edge
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
 
-      - uses: cypress-io/github-action@v6
+      - uses: cypress-io/github-action@f790eee7a50d9505912f50c2095510be7de06aa7 # v6
         with:
           browser: edge
 
@@ -71,8 +81,10 @@ jobs:
     runs-on: macos-latest
     name: E2E on WebKit
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
 
-      - uses: cypress-io/github-action@v6
+      - uses: cypress-io/github-action@f790eee7a50d9505912f50c2095510be7de06aa7 # v6
         with:
           browser: webkit