diff --git a/.github/workflows/label-sync.yml b/.github/workflows/label-sync.yml
index d6bd296..08c51f4 100644
--- a/.github/workflows/label-sync.yml
+++ b/.github/workflows/label-sync.yml
@@ -21,7 +21,7 @@ jobs:
     name: Sync labels
     runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@v4                                       # v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683                                       # v4
     - uses: srealmoreno/label-sync-action@850ba5cef2b25e56c6c420c4feed0319294682fd # v2
       with:
         clean-labels: true
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index c7064a1..ca067b5 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-24.04
 
     steps:
-    - uses: actions/checkout@v4                                       # v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683                                       # v4
     - uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f # v4
       with:
         path: ~/.cache/pre-commit
diff --git a/.github/workflows/pythonpackage.yml b/.github/workflows/pythonpackage.yml
index df186b8..fee5b00 100644
--- a/.github/workflows/pythonpackage.yml
+++ b/.github/workflows/pythonpackage.yml
@@ -19,12 +19,12 @@ jobs:
         - '3.13'
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
       with:
         python-version: ${{ matrix.python-version }}
-    - uses: astral-sh/setup-uv@v5
+    - uses: astral-sh/setup-uv@4db96194c378173c656ce18a155ffc14a9fc4355 # v5
     - run: uv pip install --system -r requirements-test.txt
     - name: Compile
       env:
diff --git a/.github/workflows/setup.yml b/.github/workflows/setup.yml
index c90c72e..e0f4d7d 100644
--- a/.github/workflows/setup.yml
+++ b/.github/workflows/setup.yml
@@ -27,22 +27,22 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
     - name: Set up QEMU
       if: runner.os == 'Linux'
-      uses: docker/setup-qemu-action@v3
+      uses: docker/setup-qemu-action@4574d27a4764455b42196d70a065bc6853246a25 # v3
       with:
         platforms: all
 
     - name: Build wheel
-      uses: pypa/cibuildwheel@v2.22.0
+      uses: pypa/cibuildwheel@ee63bf16da6cddfb925f542f2c7b59ad50e93969 # v2.22.0
       env:
         CIBW_ARCHS: ${{ matrix.config.arch }}
         CIBW_BUILD: cp*-${{ matrix.config.platform }}
         CIBW_SKIP: cp36* cp37* cp38*
 
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4
       with:
         path: ./wheelhouse/*.whl
         name: wheel-${{ matrix.config.platform }}
@@ -50,15 +50,15 @@ jobs:
   sdist:
     runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
       with:
         python-version: '3.13'
-    - uses: astral-sh/setup-uv@v5
+    - uses: astral-sh/setup-uv@4db96194c378173c656ce18a155ffc14a9fc4355 # v5
     - name: build
       run: uv build --sdist
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4
       with:
         path: dist/*.tar.gz
         name: sdist
@@ -69,13 +69,13 @@ jobs:
     - build_wheels
     runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
       with:
         python-version: '3.13'
-    - uses: astral-sh/setup-uv@v5
-    - uses: actions/download-artifact@v4
+    - uses: astral-sh/setup-uv@4db96194c378173c656ce18a155ffc14a9fc4355 # v5
+    - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
       with:
         path: dist
         merge-multiple: true
@@ -90,12 +90,12 @@ jobs:
       # this permission is mandatory for trusted publishing
       id-token: write
     steps:
-    - uses: actions/download-artifact@v4
+    - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
       with:
         path: dist
         merge-multiple: true
 
-    - uses: astral-sh/setup-uv@v5
+    - uses: astral-sh/setup-uv@4db96194c378173c656ce18a155ffc14a9fc4355 # v5
     - name: Publish package distributions to PyPI
       run: uv publish --trusted-publishing always
 permissions: