diff --git a/.github/workflows/changelog.yaml b/.github/workflows/changelog.yaml
index ea8787c..e42fd2e 100644
--- a/.github/workflows/changelog.yaml
+++ b/.github/workflows/changelog.yaml
@@ -14,14 +14,14 @@ jobs:
     steps:
 
       -
-        uses: actions/checkout@v3
+        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4
         with:
           fetch-depth: 0
 
       # https://github.com/tj-actions/changed-files/blob/main/README.md#inputs
       -
         name: Detect Changes
-        uses: tj-actions/changed-files@v41.0.0
+        uses: tj-actions/changed-files@d6babd6899969df1a11d14c368283ea4436bca78 # v44.5.2
         id: changes
         with:
           files: |
@@ -38,7 +38,7 @@ jobs:
       # https://github.com/peter-evans/create-pull-request#action-inputs
       -
         name: Create Pull Request
-        uses: peter-evans/create-pull-request@v4
+        uses: peter-evans/create-pull-request@6d6857d36972b65feb161a90e484f2984215f83e # v6
         with:
           token: "${{ secrets.GITHUB_TOKEN }}"
           branch: "change/${{ github.sha }}"
diff --git a/.github/workflows/pr-docker_test.yaml b/.github/workflows/pr-docker_test.yaml
index 582406d..f5e6e1f 100644
--- a/.github/workflows/pr-docker_test.yaml
+++ b/.github/workflows/pr-docker_test.yaml
@@ -15,15 +15,15 @@ jobs:
 
       -
         name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4
 
       -
         name: Set up Docker Build
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb # v3
 
       -
         name: Build Docker Test Image
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
         id: build
         with:
           context: .
diff --git a/.github/workflows/tag-docker_test_build_push.yaml b/.github/workflows/tag-docker_test_build_push.yaml
index 81dc671..aa380d4 100644
--- a/.github/workflows/tag-docker_test_build_push.yaml
+++ b/.github/workflows/tag-docker_test_build_push.yaml
@@ -24,15 +24,15 @@ jobs:
 
       -
         name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4
 
       -
         name: Set up Docker Build
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb # v3
 
       -
         name: Build Docker Test Image
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
         id: build
         with:
           context: .
@@ -47,7 +47,7 @@ jobs:
 
       - name: Get Docker Image Metadata
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5
         with:
           images: |
             quay.io/k8start/http-headers
@@ -61,18 +61,18 @@ jobs:
 
       - name: Set up QEMU
         id: qemu
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3
 
       - name: Login to Docker Hub Container Registry
         if: ${{ github.event_name != 'pull_request' }}
-        uses: docker/login-action@v2
+        uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_ROBOT_TOKEN }}
 
       - name: Login to GHCR.io Container Registry
         if: ${{ github.event_name != 'pull_request' }}
-        uses: docker/login-action@v2
+        uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -80,7 +80,7 @@ jobs:
 
       - name: Login to Quay.io Container Registry
         if: ${{ github.event_name != 'pull_request' }}
-        uses: docker/login-action@v2
+        uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3
         with:
           registry: quay.io
           username: ${{ secrets.QUAY_USERNAME }}
@@ -116,7 +116,7 @@ jobs:
       -
         # Push other images
         name: Build and Push Docker Images
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
         id: build-all
         with:
           context: .