diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
index c8b501e..972fe57 100644
--- a/.github/workflows/actionlint.yml
+++ b/.github/workflows/actionlint.yml
@@ -17,7 +17,7 @@ jobs:
   actionlint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: Run actionlint
         shell: bash
         run: |
diff --git a/.github/workflows/auto-triage.yml b/.github/workflows/auto-triage.yml
index 07bcadc..88f9e6c 100644
--- a/.github/workflows/auto-triage.yml
+++ b/.github/workflows/auto-triage.yml
@@ -63,7 +63,7 @@ jobs:
           fetch-depth: 0
 
       - name: Run Claude Code (Auto-Triage)
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@36a69b6a90b850823f86de06fdfd56264772ad98 # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           show_full_output: true
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 61ba3f5..11cc4e6 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -39,7 +39,7 @@ jobs:
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@36a69b6a90b850823f86de06fdfd56264772ad98 # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           additional_permissions: |
diff --git a/.github/workflows/pr-autofix.yml b/.github/workflows/pr-autofix.yml
index 71bdfd0..d4bb49a 100644
--- a/.github/workflows/pr-autofix.yml
+++ b/.github/workflows/pr-autofix.yml
@@ -184,7 +184,7 @@ jobs:
           } >> "$GITHUB_OUTPUT"
 
       - name: Run Claude Code (auto-fix PR)
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@36a69b6a90b850823f86de06fdfd56264772ad98 # v1
         env:
           PR_HEAD_REF: ${{ steps.meta.outputs.head_ref }}
           PR_BASE_REF: ${{ steps.meta.outputs.base_ref }}