diff --git a/.github/actions/pr-comment/action.yml b/.github/actions/pr-comment/action.yml
index 75eb547562..6ee1e7d813 100644
--- a/.github/actions/pr-comment/action.yml
+++ b/.github/actions/pr-comment/action.yml
@@ -15,7 +15,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/download-artifact@v4
+    - uses: actions/download-artifact@9c19ed7fe5d278cd354c7dfd5d3b88589c7e2395 # v4.1.6
       with:
         run-id: ${{ github.event.workflow_run.id }}
         name: ${{ inputs.name }}
@@ -32,7 +32,7 @@ runs:
           echo "[:arrow_down: Download logs]($(cat log-url))" >> contents
         fi
 
-    - uses: thollander/actions-comment-pull-request@v2
+    - uses: thollander/actions-comment-pull-request@fabd468d3a1a0b97feee5f6b9e499eab0dd903f6 # v2.5.0
       with:
         filePath: contents
         mode: ${{ inputs.mode }}
diff --git a/.github/actions/quic-interop-runner/action.yml b/.github/actions/quic-interop-runner/action.yml
index ec4db19fe1..3f5547d3c6 100644
--- a/.github/actions/quic-interop-runner/action.yml
+++ b/.github/actions/quic-interop-runner/action.yml
@@ -40,7 +40,7 @@ runs:
         sudo apt-get install -y --no-install-recommends tshark
       shell: bash
 
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
       with:
         python-version: 3.8
         cache: 'pip'
@@ -88,7 +88,7 @@ runs:
           mv result.json.tmp result.json
       shell: bash
 
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
       with:
         name: '${{ inputs.client }} vs. ${{ inputs.server }} results'
         path: |
diff --git a/.github/actions/rust/action.yml b/.github/actions/rust/action.yml
index 4b03b37b8d..b363738cca 100644
--- a/.github/actions/rust/action.yml
+++ b/.github/actions/rust/action.yml
@@ -13,7 +13,7 @@ runs:
   using: composite
   steps:
     - name: Install Rust
-      uses: dtolnay/rust-toolchain@master
+      uses: dtolnay/rust-toolchain@bb45937a053e097f8591208d8e74c90db1873d07 # master
       with:
         toolchain: ${{ inputs.version }}
         components: ${{ inputs.components }}
@@ -35,7 +35,7 @@ runs:
     # sccache slows CI down, so we leave it disabled.
     # Leaving the steps below commented out, so we can re-evaluate enabling it later.
     # - name: Use sccache
-    #   uses: mozilla-actions/sccache-action@v0.0.4
+    #   uses: mozilla-actions/sccache-action@2e7f9ec7921547d4b46598398ca573513895d0bd # v0.0.4
 
     # - name: Enable sscache
     #   shell: bash
@@ -53,6 +53,6 @@ runs:
 
     # Ditto for rust-cache.
     # - name: Use Rust cache
-    #   uses: Swatinem/rust-cache@v2
+    #   uses: Swatinem/rust-cache@23bce251a8cd2ffc3c1075eaa2367cf899916d84 # v2.7.3
     #   with:
     #     cache-all-crates: "true"
diff --git a/.github/workflows/qns.yml b/.github/workflows/qns.yml
index 8ffe186605..45ea31ffc5 100644
--- a/.github/workflows/qns.yml
+++ b/.github/workflows/qns.yml
@@ -129,7 +129,7 @@ jobs:
         pair: ${{ fromJson(needs.implementations.outputs.pairs) }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@9c19ed7fe5d278cd354c7dfd5d3b88589c7e2395 # v4.1.6
         with:
           name: '${{ env.LATEST }} Docker image'
           path: /tmp
@@ -142,7 +142,7 @@ jobs:
           echo "client=$(echo "$PAIR" | cut -d% -f1)" >> "$GITHUB_OUTPUT"
           echo "server=$(echo "$PAIR" | cut -d% -f2)" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
 
       # TODO: Replace once https://github.com/quic-interop/quic-interop-runner/pull/356 is merged.
       - uses: ./.github/actions/quic-interop-runner
@@ -158,7 +158,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@9c19ed7fe5d278cd354c7dfd5d3b88589c7e2395 # v4.1.6
         with:
           pattern: '*results'
           path: results