diff --git a/.github/workflows/check-pr-title.yaml b/.github/workflows/check-pr-title.yaml
index ea0cd864..bcbd2ad4 100644
--- a/.github/workflows/check-pr-title.yaml
+++ b/.github/workflows/check-pr-title.yaml
@@ -31,7 +31,7 @@
             requireScope: false
             wip: true
 
-        - uses: marocchino/sticky-pull-request-comment@v2.9.0
+        - uses: marocchino/sticky-pull-request-comment@331f8f5b4215f0445d3c07b4967662a32a2d3e31 # v2.9.0
           # When the previous steps fails, the workflow would stop. By adding this
           # condition you can continue the execution with the populated error message.
           if: always() && (steps.lint_pr_title.outputs.error_message != null)
@@ -53,7 +53,7 @@
 
         # Delete a previous comment when the issue has been resolved
         - if: ${{ steps.lint_pr_title.outputs.error_message == null }}
-          uses: marocchino/sticky-pull-request-comment@v2.9.0
+          uses: marocchino/sticky-pull-request-comment@331f8f5b4215f0445d3c07b4967662a32a2d3e31 # v2.9.0
           with:
             header: pr-title-lint-error
             GITHUB_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/checks.yaml b/.github/workflows/checks.yaml
index f4b4a1b5..1a4bf59a 100644
--- a/.github/workflows/checks.yaml
+++ b/.github/workflows/checks.yaml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@4bc047ad259df6fc24a6c9b0f9a0cb08cf17fbe5 # v2
       - name: Install Dependencies
         run: bun install
       - name: Runs Prettier Formatter
@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@4bc047ad259df6fc24a6c9b0f9a0cb08cf17fbe5 # v2
       - name: Install Dependencies
         run: bun install
       - name: Runs cSpell Spell Checker
@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@4bc047ad259df6fc24a6c9b0f9a0cb08cf17fbe5 # v2
       - name: Install Dependencies
         run: bun install
       - name: Runs Markdown Linter
@@ -48,7 +48,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@4bc047ad259df6fc24a6c9b0f9a0cb08cf17fbe5 # v2
       - name: Install Dependencies
         run: bun install
       - name: Runs ESLint
diff --git a/.github/workflows/deploy-preview.yml b/.github/workflows/deploy-preview.yml
index eb3f7358..7ae3c2b8 100644
--- a/.github/workflows/deploy-preview.yml
+++ b/.github/workflows/deploy-preview.yml
@@ -21,7 +21,7 @@ jobs:
     steps:
       - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
 
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@4bc047ad259df6fc24a6c9b0f9a0cb08cf17fbe5 # v2
 
       - name: "Install dependencies"
         run: bun install --production --frozen-lockfile
diff --git a/.github/workflows/deploy-prod.yml b/.github/workflows/deploy-prod.yml
index 0d6f0aa0..6f781840 100644
--- a/.github/workflows/deploy-prod.yml
+++ b/.github/workflows/deploy-prod.yml
@@ -26,7 +26,7 @@ jobs:
         with:
           persist-credentials: false # <--- checking this in commit context
 
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@4bc047ad259df6fc24a6c9b0f9a0cb08cf17fbe5 # v2
 
       - name: "Install dependencies"
         run: bun install --production --frozen-lockfile
diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index c03177de..0163822a 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -27,7 +27,7 @@ jobs:
         with:
           ref: "${{ github.event.inputs.ref }}"
 
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@4bc047ad259df6fc24a6c9b0f9a0cb08cf17fbe5 # v2
 
       - name: "Install dependencies"
         run: bun install --production --frozen-lockfile
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 033ba665..79e98e66 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -18,10 +18,10 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4
         with:
           node-version: 'latest'
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@4bc047ad259df6fc24a6c9b0f9a0cb08cf17fbe5 # v2
 
       - name: "Install dependencies"
         run: bun install --production --frozen-lockfile