diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index 3bbe26da0..628262028 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -10,15 +10,15 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Checkout repository
-              uses: actions/checkout@v4
+              uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
             - name: Install pnpm
-              uses: pnpm/action-setup@v4
+              uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
               with:
                   version: 9
 
             - name: Install Node.js
-              uses: actions/setup-node@v4
+              uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
               with:
                   node-version-file: ".node-version"
                   cache: pnpm
@@ -30,7 +30,7 @@ jobs:
               run: pnpm run build
 
             - name: Deploy site
-              uses: JamesIves/github-pages-deploy-action@v4
+              uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f # v4
               with:
                   branch: gh-pages
                   folder: out
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 417eecfae..5525eb71f 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -10,5 +10,5 @@ on:
 
 jobs:
   test:
-    uses: stegripe/workflows/.github/workflows/pnpm-lint-and-test.yaml@main
+    uses: stegripe/workflows/.github/workflows/pnpm-lint-and-test.yaml@564a369e6527436f62073f0f1a0ea6626596c6a9 # main
     secrets: inherit