diff --git a/.github/workflows/check-approval.yaml b/.github/workflows/check-approval.yaml
index 5a052f74..c3ef0ba6 100644
--- a/.github/workflows/check-approval.yaml
+++ b/.github/workflows/check-approval.yaml
@@ -12,7 +12,7 @@ jobs:
       contents: read # To list commits in pull requests
     steps:
       - id: param
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
             const defaultConfig = {
diff --git a/.github/workflows/close-issue.yaml b/.github/workflows/close-issue.yaml
index 58974834..34a3cd19 100644
--- a/.github/workflows/close-issue.yaml
+++ b/.github/workflows/close-issue.yaml
@@ -11,7 +11,7 @@ jobs:
       issues: write
     if: "false"
     steps:
-      - uses: suzuki-shunsuke/issue-close-lock-action@v0.1.0
+      - uses: suzuki-shunsuke/issue-close-lock-action@231aefd9a92cddfd2eb51e60965e9468f3d592bd # v0.1.0
         with:
           issue_number: ${{github.event.issue.number}}
           message: |
diff --git a/.github/workflows/test-pinact.yaml b/.github/workflows/test-pinact.yaml
index 23badab1..8330d828 100644
--- a/.github/workflows/test-pinact.yaml
+++ b/.github/workflows/test-pinact.yaml
@@ -13,9 +13,9 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
         with:
           persist-credentials: false
-      - uses: actions/cache@v3.3.1
+      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
   actionlint:
-    uses: suzuki-shunsuke/actionlint-workflow/.github/workflows/actionlint.yaml@v0.5.0
+    uses: suzuki-shunsuke/actionlint-workflow/.github/workflows/actionlint.yaml@b6a5f966d4504893b2aeb60cf2b0de8946e48504 # v0.5.0
     with:
       aqua_version: v2.3.4
     permissions:
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index ea9c0f95..9526e0cb 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -17,4 +17,4 @@ jobs:
       pull-requests: write
       contents: read
     steps:
-      - uses: suzuki-shunsuke/notify-bot-pr-event-action@pr/1
+      - uses: suzuki-shunsuke/notify-bot-pr-event-action@d8fee991e650d1b7b56dee1db19d3695148a19be # pr/1