diff --git a/action.yml b/action.yml
index d17cc9a3..185ce07b 100644
--- a/action.yml
+++ b/action.yml
@@ -31,11 +31,11 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/setup-node@v5
+    - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
       with:
         node-version: 20.12.2
 
-    - uses: actions/setup-python@v6
+    - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
       with:
         python-version: 3.x
 
@@ -46,7 +46,7 @@ runs:
         cd gitstream && mkdir repo
 
     - name: Checkout base branch
-      uses: actions/checkout@v5
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         repository: ${{ inputs.full_repository }}
         ref: ${{ inputs.base_ref }}
@@ -55,7 +55,7 @@ runs:
 
     - name: Escape single quotes
       id: safe-strings
-      uses: actions/github-script@v8
+      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
       env:
         BASE_REF_ARG: ${{ inputs.base_ref }}
         HEAD_REF_ARG: ${{ inputs.head_ref }}
@@ -84,7 +84,7 @@ runs:
           }
 
     - name: Get condition variables
-      uses: actions/github-script@v8
+      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
       env:
         IS_NON_COMMIT_ARG: ${{ fromJSON(fromJSON(inputs.client_payload)).isNonCommitEvent }}
         ENABLE_CACHE_ARG: ${{ env.ENABLE_CACHE }}
@@ -96,7 +96,7 @@ runs:
 
     - name: Download cache artifact for cm repo
       id: download-cache-for-cm-repo
-      uses: actions/download-artifact@v5
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
       if: ${{ env.SKIP_GIT_CLONE == 'true' && fromJSON(fromJSON(inputs.client_payload)).hasCmRepo == true }}
       continue-on-error: true
       with:
@@ -108,7 +108,7 @@ runs:
 
     - name: Download cache artifact when cmRepo is false
       id: download-cache
-      uses: actions/download-artifact@v5
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
       if: ${{ env.SKIP_GIT_CLONE == 'true' && fromJSON(fromJSON(inputs.client_payload)).hasCmRepo == false}}
       continue-on-error: true
       with:
@@ -119,7 +119,7 @@ runs:
         path: code/output
 
     - name: Check if download cache artifact failed
-      uses: actions/github-script@v8
+      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
       env:
         ARTIFACT_OUTCOME_ARG: ${{ steps.download-cache.outcome }}
         ARTIFACT_OUTCOME_CM_REPO_ARG: ${{ steps.download-cache-for-cm-repo.outcome }}
@@ -146,7 +146,7 @@ runs:
       run: cd gitstream && mkdir cm
 
     - name: Checkout cm repo
-      uses: actions/checkout@v5
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       if: ${{ fromJSON(fromJSON(inputs.client_payload)).hasCmRepo == true && env.SHOULD_CHECKOUT == 'true'}}
       with:
         repository: '${{ fromJSON(fromJSON(inputs.client_payload)).owner }}/${{ fromJSON(fromJSON(inputs.client_payload)).cmRepo }}'
@@ -154,7 +154,7 @@ runs:
         path: gitstream/cm/
 
     - name: Checkout cm org
-      uses: actions/checkout@v5
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       if: ${{ fromJSON(fromJSON(inputs.client_payload)).hasCmOrg == true && env.SHOULD_CHECKOUT == 'true'}}
       with:
         repository: 'cm/cm'
@@ -187,7 +187,7 @@ runs:
 
     - name: Upload artifacts
       if: ${{ env.ENABLE_DEBUG_ARTIFACTS == 'true' || env.ENABLE_CACHE == 'true' }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         retention-days: 7
         name: output