diff --git a/.gitea/workflows/auto-release.yaml b/.gitea/workflows/auto-release.yaml
index b5f37f5..256038a 100644
--- a/.gitea/workflows/auto-release.yaml
+++ b/.gitea/workflows/auto-release.yaml
@@ -18,7 +18,7 @@ jobs:
 
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
 
@@ -55,7 +55,7 @@ jobs:
 
       - name: Trigger "Push tagged images" workflow
         if: steps.check_change.outputs.changed == 'true'
-        uses: actions/github-script@v9.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const workflowFileName = 'release.yaml';
diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml
index 4fd0be3..8dea127 100644
--- a/.gitea/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@@ -15,11 +15,11 @@ jobs:
   build-arm64:
     runs-on: ubuntu-latest-arm64
     steps:
-      - uses: actions/checkout@v6.0.3
-      - uses: docker/setup-qemu-action@v4.1.0
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
         with:
           image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest
-      - uses: docker/setup-buildx-action@v4.1.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Build image
         run: |
@@ -35,11 +35,11 @@ jobs:
   build-amd64:
     runs-on: ubuntu-latest-amd64
     steps:
-      - uses: actions/checkout@v6.0.3
-      - uses: docker/setup-qemu-action@v4.1.0
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
         with:
           image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest
-      - uses: docker/setup-buildx-action@v4.1.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Build image
         run: |
diff --git a/.gitea/workflows/markdown-linters.yaml b/.gitea/workflows/markdown-linters.yaml
index a2e4b41..37d3812 100644
--- a/.gitea/workflows/markdown-linters.yaml
+++ b/.gitea/workflows/markdown-linters.yaml
@@ -16,7 +16,7 @@ jobs:
     runs-on:
     - ubuntu-latest
     steps:
-    - uses: actions/checkout@v6.0.3
-    - uses: DavidAnson/markdownlint-cli2-action@v21.0.0
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: DavidAnson/markdownlint-cli2-action@30a0e04f1870d58f8d717450cc6134995f993c63 # v21.0.0
       with:
         globs: '**/*.md'
diff --git a/.gitea/workflows/release.yaml b/.gitea/workflows/release.yaml
index f2e7b87..316be55 100644
--- a/.gitea/workflows/release.yaml
+++ b/.gitea/workflows/release.yaml
@@ -27,17 +27,17 @@ jobs:
           echo "version_raw=${VERSION}" >> $GITHUB_OUTPUT
           echo "version_cleaned=${VERSION/v/}" >> $GITHUB_OUTPUT
 
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-tags: true
           ref: "${{ steps.version_extraction.outputs.version_raw }}"
 
-      - uses: docker/setup-qemu-action@v4.1.0
+      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
         with:
           image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest
-      - uses: docker/setup-buildx-action@v4.1.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
-      - uses: docker/login-action@v4.2.0
+      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: git.cryptic.systems
           username: ${{ github.repository_owner }}
@@ -69,17 +69,17 @@ jobs:
           echo "version_raw=${VERSION}" >> $GITHUB_OUTPUT
           echo "version_cleaned=${VERSION/v/}" >> $GITHUB_OUTPUT
 
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-tags: true
           ref: "${{ steps.version_extraction.outputs.version_raw }}"
 
-      - uses: docker/setup-qemu-action@v4.1.0
+      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
         with:
           image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest
-      - uses: docker/setup-buildx-action@v4.1.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
-      - uses: docker/login-action@v4.2.0
+      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: git.cryptic.systems
           username: ${{ github.repository_owner }}
@@ -114,7 +114,7 @@ jobs:
           echo "version_raw=${VERSION}" >> $GITHUB_OUTPUT
           echo "version_cleaned=${VERSION/v/}" >> $GITHUB_OUTPUT
 
-      - uses: docker/login-action@v4.2.0
+      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: git.cryptic.systems
           username: ${{ github.repository_owner }}
diff --git a/.gitea/workflows/update-docker-hub-description.yaml b/.gitea/workflows/update-docker-hub-description.yaml
index 8c5fd4c..ba35bc3 100644
--- a/.gitea/workflows/update-docker-hub-description.yaml
+++ b/.gitea/workflows/update-docker-hub-description.yaml
@@ -13,8 +13,8 @@ jobs:
     runs-on:
     - ubuntu-latest
     steps:
-    - uses: actions/checkout@v6.0.3
-    - uses: peter-evans/dockerhub-description@v5.0.0
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
       with:
         username: ${{ secrets.DOCKER_IO_USERNAME }}
         password: ${{ secrets.DOCKER_IO_PASSWORD }}