diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index b6b687f..65767a7 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -8,12 +8,12 @@ on:
 
 jobs:
   check:
-    uses: wetransform/gha-workflows/.github/workflows/gradle-library-check.yml@a78448bc4e8511a19e0362cfc0c450d76ca68b7f
+    uses: wetransform/gha-workflows/.github/workflows/gradle-library-check.yml@a78448bc4e8511a19e0362cfc0c450d76ca68b7f # v2.1.0
     with:
       java-version: 17
 
   docker:
-    uses: wetransform/gha-workflows/.github/workflows/gradle-service-check.yml@a78448bc4e8511a19e0362cfc0c450d76ca68b7f
+    uses: wetransform/gha-workflows/.github/workflows/gradle-service-check.yml@a78448bc4e8511a19e0362cfc0c450d76ca68b7f # v2.1.0
     with:
       java-version: 17
       image-tag: wetransform/hale-cli:latest # image to scan
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 6f57f51..94f821c 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -14,7 +14,7 @@ concurrency:
 
 jobs:
   artifacts:
-    uses: wetransform/gha-workflows/.github/workflows/gradle-library.yml@a78448bc4e8511a19e0362cfc0c450d76ca68b7f
+    uses: wetransform/gha-workflows/.github/workflows/gradle-library.yml@a78448bc4e8511a19e0362cfc0c450d76ca68b7f # v2.1.0
     with:
       java-version: 17
       build-tasks: clean check distZip buildDeb
@@ -26,7 +26,7 @@ jobs:
 
   docker:
     # FIXME both master and devel will push latest - only one should
-    uses: wetransform/gha-workflows/.github/workflows/gradle-service-publish.yml@a78448bc4e8511a19e0362cfc0c450d76ca68b7f
+    uses: wetransform/gha-workflows/.github/workflows/gradle-service-publish.yml@a78448bc4e8511a19e0362cfc0c450d76ca68b7f # v2.1.0
     with:
       java-version: 17
       image-tag: wetransform/hale-cli:latest # image to scan