diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
index da2e6c6..792fa8b 100644
--- a/.github/workflows/actionlint.yml
+++ b/.github/workflows/actionlint.yml
@@ -12,7 +12,12 @@ jobs:
   job-1:
     runs-on: ubuntu-latest
     steps:       
-    - uses: actions/checkout@v3
+    - name: Harden Runner
+      uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0
+      with:
+        egress-policy: audit
+
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
     - uses: devops-actions/actionlint@48ca80d7da4ffd5ed31b7981702bc6bb4b242c63 #v0.1.2
       continue-on-error: true
       id: action-lint
diff --git a/.github/workflows/filediff.yml b/.github/workflows/filediff.yml
index 74a7dd8..fab476d 100644
--- a/.github/workflows/filediff.yml
+++ b/.github/workflows/filediff.yml
@@ -7,11 +7,16 @@ jobs:
     name: filediff
     runs-on: ubuntu-latest
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0
+        with:
+          egress-policy: audit
+
       - name: Checkout default branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
 
       - name: Create filediff comment
-        uses: Shopify/filediff@main
+        uses: Shopify/filediff@a662df8303d1056aa3561b5524610ae65b63fc78 # main
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with: