diff --git a/.github/actions/sbom-generation/action.yml b/.github/actions/sbom-generation/action.yml
index 322a486..8d40846 100644
--- a/.github/actions/sbom-generation/action.yml
+++ b/.github/actions/sbom-generation/action.yml
@@ -15,7 +15,7 @@ runs:
 
   steps:
     - name: Generate CycloneDX SBOM
-      uses: anchore/sbom-action@v0.24.0
+      uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
       with:
         file: ${{ inputs.file-to-scan }}
         format: cyclonedx-json
@@ -23,7 +23,7 @@ runs:
         upload-release-assets: false
 
     - name: Generate SPDX SBOM
-      uses: anchore/sbom-action@v0.24.0
+      uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
       with:
         file: ${{ inputs.file-to-scan }}
         format: spdx-json
diff --git a/.github/workflows/rust-coverage.yml b/.github/workflows/rust-coverage.yml
index 52a0651..df9d0f5 100644
--- a/.github/workflows/rust-coverage.yml
+++ b/.github/workflows/rust-coverage.yml
@@ -11,13 +11,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           submodules: "true"
 
       # Checkout the coverage scripts from the same commit as this reusable workflow into the .shared directory
       - name: Checkout coverage scripts
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ job.workflow_repository }}
           ref: ${{ job.workflow_sha }}
@@ -27,7 +27,7 @@ jobs:
 
       - name: Use cache
         id: rust-cache
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           key: coverage
 
@@ -37,7 +37,7 @@ jobs:
 
       - name: Cache cargo-llvm-cov
         id: llvm-cov-cache
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.cargo/bin/cargo-llvm-cov
           key: cargo-llvm-cov-${{ runner.os }}-${{ runner.arch }}