diff --git a/.github/workflows/changelog-preview.yml b/.github/workflows/changelog-preview.yml
index 3788b2960..2f683bdd7 100644
--- a/.github/workflows/changelog-preview.yml
+++ b/.github/workflows/changelog-preview.yml
@@ -15,5 +15,5 @@ permissions:
 
 jobs:
   changelog-preview:
-    uses: getsentry/craft/.github/workflows/changelog-preview.yml@v2
+    uses: getsentry/craft/.github/workflows/changelog-preview.yml@f4889d04564e47311038ecb6b910fef6b6cf1363 # v2
     secrets: inherit
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a3a625f43..e6ae3d48c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -70,7 +70,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
       - name: Download UPM package
         uses: vaind/download-artifact@e7141b6a94ef28aa3d828b52830cfa1f406a1848 # v4-with-wait-timeout
@@ -116,7 +116,7 @@ jobs:
       UNITY_PATH: docker exec unity unity-editor
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
       - name: Free Disk Space (Ubuntu)
         uses: jlumbroso/free-disk-space@f68fdb76e2ea636224182cfb7377ff9a1708f9b8 # v1.3.0
@@ -164,7 +164,7 @@ jobs:
 
       - name: Restore cached build without Sentry
         id: cache-build-nosentry
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: samples/IntegrationTest/Build-NoSentry
           key: build-nosentry-${{ matrix.build_platform }}-${{ matrix.unity-version }}
@@ -396,7 +396,7 @@ jobs:
     needs: [test-build-webgl, test-build-android, test-compile-ios, test-build-linux, test-build-windows]
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
       - name: Download all build size measurements
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
diff --git a/.github/workflows/danger.yml b/.github/workflows/danger.yml
index 8de605450..0ec9dcccf 100644
--- a/.github/workflows/danger.yml
+++ b/.github/workflows/danger.yml
@@ -7,4 +7,4 @@ jobs:
   danger:
     runs-on: ubuntu-latest
     steps:
-      - uses: getsentry/github-workflows/danger@v3
+      - uses: getsentry/github-workflows/danger@26f565c05d0dd49f703d238706b775883037d76b # v3
diff --git a/.github/workflows/test-build-android.yml b/.github/workflows/test-build-android.yml
index 6ccde026e..d3bf9f7f9 100644
--- a/.github/workflows/test-build-android.yml
+++ b/.github/workflows/test-build-android.yml
@@ -56,7 +56,7 @@ jobs:
 
       - name: Restore cached build without Sentry
         id: cache-build-nosentry
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: samples/IntegrationTest/Build-NoSentry
           key: build-nosentry-Android-${{ inputs.unity-version }}
diff --git a/.github/workflows/test-build-ios.yml b/.github/workflows/test-build-ios.yml
index b4baaec74..eb077748d 100644
--- a/.github/workflows/test-build-ios.yml
+++ b/.github/workflows/test-build-ios.yml
@@ -62,7 +62,7 @@ jobs:
 
       - name: Restore cached build without Sentry
         id: cache-build-nosentry
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: samples/IntegrationTest/Build-NoSentry
           key: build-nosentry-iOS-${{ inputs.unity-version }}
diff --git a/.github/workflows/test-build-linux.yml b/.github/workflows/test-build-linux.yml
index 0b8f034f0..393b6f7d2 100644
--- a/.github/workflows/test-build-linux.yml
+++ b/.github/workflows/test-build-linux.yml
@@ -67,7 +67,7 @@ jobs:
 
       - name: Restore cached build without Sentry
         id: cache-build-nosentry
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: samples/IntegrationTest/Build-NoSentry
           key: build-nosentry-Linux-${{ inputs.unity-version }}
diff --git a/.github/workflows/test-build-windows.yml b/.github/workflows/test-build-windows.yml
index 2e40baf13..fb5f2e458 100644
--- a/.github/workflows/test-build-windows.yml
+++ b/.github/workflows/test-build-windows.yml
@@ -58,7 +58,7 @@ jobs:
 
       - name: Restore cached build without Sentry
         id: cache-build-nosentry
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: samples/IntegrationTest/Build-NoSentry
           key: build-nosentry-Windows-${{ inputs.unity-version }}
diff --git a/.github/workflows/test-compile-ios.yml b/.github/workflows/test-compile-ios.yml
index 770492304..454acda08 100644
--- a/.github/workflows/test-compile-ios.yml
+++ b/.github/workflows/test-compile-ios.yml
@@ -28,7 +28,7 @@ jobs:
       - name: Restore cached compiled iOS build without Sentry
         if: ${{ inputs.init-type == 'runtime' }}
         id: cache-compiled-nosentry
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: IntegrationTest-NoSentry.app
           key: build-nosentry-iOS-compiled-${{ inputs.unity-version }}
diff --git a/.github/workflows/update-deps.yml b/.github/workflows/update-deps.yml
index 47a66e751..948fddac2 100644
--- a/.github/workflows/update-deps.yml
+++ b/.github/workflows/update-deps.yml
@@ -26,7 +26,7 @@ jobs:
             path: src/sentry-dotnet
           - name: CLI
             path: modules/sentry-cli.properties
-    uses: getsentry/github-workflows/.github/workflows/updater.yml@v2
+    uses: getsentry/github-workflows/.github/workflows/updater.yml@1949ea01ec2da6139d1bcc306c372e6aea76fb72 # v2
     with:
       name: ${{ matrix.name }}
       path: ${{ matrix.path }}