diff --git a/.github/workflows/on_pull_request.yaml b/.github/workflows/on_pull_request.yaml
index e9f3a3de..c49fab4d 100644
--- a/.github/workflows/on_pull_request.yaml
+++ b/.github/workflows/on_pull_request.yaml
@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
       - name: Install dependencies
         run: python3 -m pip install tox
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 1987d17d..65fa27c7 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -32,13 +32,13 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           fetch-depth: 0
           ref: ${{ inputs.source_branch }}
 
       - name: Select CharmHub channel
-        uses: canonical/charming-actions/channel@2.3.0
+        uses: canonical/charming-actions/channel@a4a19eaf56a69deb271f1f76d7babf8107c3a1b5 # 2.3.0
         id: select-channel
         if: ${{ inputs.destination_channel == '' }}
 
@@ -51,7 +51,7 @@ jobs:
           echo "::set-output name=destination_channel::$destination_channel"
 
       - name: Upload charm to CharmHub
-        uses: canonical/charming-actions/upload-charm@2.3.0
+        uses: canonical/charming-actions/upload-charm@a4a19eaf56a69deb271f1f76d7babf8107c3a1b5 # 2.3.0
         with:
           credentials: ${{ secrets.CHARMCRAFT_CREDENTIALS }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/release_libs.yaml b/.github/workflows/release_libs.yaml
index 608b8ee3..aca54009 100644
--- a/.github/workflows/release_libs.yaml
+++ b/.github/workflows/release_libs.yaml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4
         with:
           fetch-depth: 0
       - name: Release charm library
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index 5575fcb5..f2aea933 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4
 
       - name: Install dependencies
         run: python -m pip install tox
@@ -25,7 +25,7 @@ jobs:
       - unit-test
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
       - name: Setup operator environment
         uses: charmed-kubernetes/actions-operator@main