diff --git a/.github/workflows/build_package.yml b/.github/workflows/build_package.yml
index 8d038674..56717261 100644
--- a/.github/workflows/build_package.yml
+++ b/.github/workflows/build_package.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       with:
         path: buildsrc
     - name: Prepare build environment
@@ -28,7 +28,7 @@ jobs:
         sudo chown -R $(id -u) buildsrc/.git
         sudo install -d -o 1000 -g users repo
     - name: Use geschenkerbauer to build packages
-      uses: mutantmonkey/geschenkerbauer/action@8a59d3ba77a471258eabb184f846612597518d13
+      uses: mutantmonkey/geschenkerbauer/action@8a59d3ba77a471258eabb184f846612597518d13 # main
       env:
         PACKAGER: geschenkerbauer on github <archpkgs+github@mutantmonkey.mx>
       with:
@@ -41,11 +41,11 @@ jobs:
         done || exit 0
       working-directory: ./repo
     - name: Upload artifacts
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
       with:
         name: output
         path: repo
     - name: Generate artifact attestation
-      uses: actions/attest-build-provenance@v1
+      uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4
       with:
         subject-path: 'repo/*'
diff --git a/.github/workflows/build_updated_packages.yml b/.github/workflows/build_updated_packages.yml
index 8c50a57c..62af2fb9 100644
--- a/.github/workflows/build_updated_packages.yml
+++ b/.github/workflows/build_updated_packages.yml
@@ -17,7 +17,7 @@ jobs:
       packages: ${{ steps.get-packages.outputs.packages }}
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       with:
         fetch-depth: 0
     - name: Figure out which packages have changed since the last push
@@ -35,7 +35,7 @@ jobs:
     if: ${{ needs.evaluate.outputs.packages != '[]' }}
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       with:
         path: buildsrc
     - name: Prepare build environment
@@ -45,7 +45,7 @@ jobs:
         sudo install -d -o 1000 -g users repo
         echo "SOURCE_DATE_EPOCH=$(git -C buildsrc log -1 -i --pretty='format:%ct')" >> "$GITHUB_ENV"
     - name: Use geschenkerbauer to build packages
-      uses: mutantmonkey/geschenkerbauer/action@8a59d3ba77a471258eabb184f846612597518d13
+      uses: mutantmonkey/geschenkerbauer/action@8a59d3ba77a471258eabb184f846612597518d13 # main
       env:
         PACKAGER: geschenkerbauer on github <archpkgs+github@mutantmonkey.mx>
       with:
@@ -57,11 +57,11 @@ jobs:
         done || exit 0
       working-directory: ./repo
     - name: Upload artifacts
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
       with:
         name: build-output-${{ matrix.pkgname }}
         path: repo
     - name: Generate artifact attestation
-      uses: actions/attest-build-provenance@v1
+      uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4
       with:
         subject-path: 'repo/*'
diff --git a/.github/workflows/namcap.yml b/.github/workflows/namcap.yml
index 324cbc39..5e200e3f 100644
--- a/.github/workflows/namcap.yml
+++ b/.github/workflows/namcap.yml
@@ -14,6 +14,6 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
     - name: Check all PKGBUILDs using namcap
-      uses: mutantmonkey/geschenkerbauer/actions/namcap@c00c7f432884cbd0aee710135261383886064588
+      uses: mutantmonkey/geschenkerbauer/actions/namcap@c00c7f432884cbd0aee710135261383886064588 # main