diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 8b6aa3d..0b758be 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -2,13 +2,16 @@ name: Build & Test
 
 on: [pull_request, push]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-20.04
     container:
       image: centos:7
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       - name: install dependencies
         run: |
           yum update -y
@@ -19,7 +22,7 @@ jobs:
           pip3 install -r requirements.txt
           make dist
       - name: upload artifact
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
         with:
           name: perfspect
           path: dist/perfspect*.tgz
@@ -29,7 +32,7 @@ jobs:
     container:
       image: centos:7
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       - name: install dependencies
         run: |
           yum update -y
@@ -48,7 +51,7 @@ jobs:
           pip3 install -r requirements.txt
           pyinstaller -F hotspot.py -n hotspot --bootloader-ignore-signals --add-data "perf-map-agent/out/*:." --add-data "flamegraph.pl:." --add-data "difffolded.pl:." --add-data "stackcollapse-perf.pl:." --runtime-tmpdir . --exclude-module readline
       - name: upload artifact
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
         with:
           name: hotspot
-          path: dist/hotspot
\ No newline at end of file
+          path: dist/hotspot