diff --git a/.github/workflows/ai-code-scanner.yml b/.github/workflows/ai-code-scanner.yml
index d56af76e7..9323f9bc7 100644
--- a/.github/workflows/ai-code-scanner.yml
+++ b/.github/workflows/ai-code-scanner.yml
@@ -12,7 +12,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
 
     - name: AI Code Review
       uses: cds-snc/cds-ai-codereviewer@main
diff --git a/.github/workflows/clear-notify-cache.yaml b/.github/workflows/clear-notify-cache.yaml
index 5357a5bbb..3bbbdb6af 100644
--- a/.github/workflows/clear-notify-cache.yaml
+++ b/.github/workflows/clear-notify-cache.yaml
@@ -21,10 +21,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
 
       - name: Set up Node.js
-        uses: actions/setup-node@v2
+        uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2.5.2
         with:
           node-version: "14"
 
diff --git a/.github/workflows/smoke_test.yaml b/.github/workflows/smoke_test.yaml
index f06312c62..935ac991d 100644
--- a/.github/workflows/smoke_test.yaml
+++ b/.github/workflows/smoke_test.yaml
@@ -31,7 +31,7 @@ jobs:
         run: python -m pip install --upgrade pip
 
       - name: Get packages from cache
-        uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3.3.3
+        uses: actions/cache@f4b3439a656ba812b8cb417d2d49f9c810103092 # v3.4.0
         with:
           path: ~/.local
           key: poetry-${{ runner.os }}-${{ env.PYTHON_VERSION }}-${{ hashFiles('**/poetry.lock') }}