diff --git a/.github/workflows/compress.yml b/.github/workflows/compress.yml
index 459f21a1..bae46b88 100644
--- a/.github/workflows/compress.yml
+++ b/.github/workflows/compress.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Find symlinked paths to ignore
         id: find
         run: >-
@@ -23,7 +23,7 @@ jobs:
       - name: Check ignored paths
         run: echo ${{ steps.find.outputs.ignore }} | tr ',' '\n'
       - name: Compress Images
-        uses: calibreapp/image-actions@master
+        uses: calibreapp/image-actions@f32575787d333b0579f0b7d506ff03be63a669d1 # 1.4.1
         with:
           ignorePaths: ${{ steps.find.outputs.ignore }}
           githubToken: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index d8e380fa..1353af13 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -8,6 +8,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Validate images
         uses: ./.github/workflows/validate