diff --git a/.github/actions/lima-vm-setup/action.yml b/.github/actions/lima-vm-setup/action.yml
index def84220f..28c0d2047 100644
--- a/.github/actions/lima-vm-setup/action.yml
+++ b/.github/actions/lima-vm-setup/action.yml
@@ -13,7 +13,7 @@ runs:
   using: composite
   steps:
   - name: Install Lima
-    uses: lima-vm/lima-actions/setup@v1
+    uses: lima-vm/lima-actions/setup@55627e31b78637bf254a8b2a14da8ea7d12564e5 # v1
   - name: Cache Lima images
     uses: actions/cache@v6
     with:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 93ecc8608..8d14c8ff9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -256,7 +256,7 @@ jobs:
     - name: Run gcov
       run: sudo -E find . -name '*gcda' -type f -print0 | sudo -E xargs --null --max-args 128 gcov
     - name: Upload coverage to Codecov
-      uses: codecov/codecov-action@v7
+      uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7
       with:
         token: ${{ secrets.CODECOV_TOKEN }}
 
diff --git a/.github/workflows/manage-labels.yml b/.github/workflows/manage-labels.yml
index 2654fbe47..693e404ad 100644
--- a/.github/workflows/manage-labels.yml
+++ b/.github/workflows/manage-labels.yml
@@ -6,7 +6,7 @@ jobs:
     if: github.event_name == 'issue_comment'
     runs-on: ubuntu-latest
     steps:
-      - uses: mondeja/remove-labels-gh-action@v2
+      - uses: mondeja/remove-labels-gh-action@b7118e4ba5dca74acf1059b3cb7660378ff9ab1a # v2
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           labels: |