diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ffaf736..0e47628 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -10,10 +10,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Setup node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
           node-version: 22
           cache: 'pnpm'
@@ -28,13 +28,13 @@ jobs:
         run: pnpm run build
 
       - name: Upload Firefox (mv2)
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: stream-bypass-mv2
           path: .output/firefox-mv2
 
       - name: Upload Chrome (mv3)
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: stream-bypass-mv3
           path: .output/chrome-mv3
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index b0d8e42..1ddeb43 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -13,10 +13,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Setup node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
           node-version: 22
           cache: 'pnpm'
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index dc99bde..7540ffa 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -19,10 +19,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Setup node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
           node-version: 22
           cache: 'pnpm'
@@ -48,20 +48,20 @@ jobs:
           echo "mv3_name=$MV3_NAME" >> "$GITHUB_OUTPUT"
 
       - name: Upload mv2 as artifact
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: ${{ steps.paths.outputs.mv2_name }}
           path: ${{ steps.paths.outputs.mv2_path }}
 
       - name: Upload mv3 as artifact
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: ${{ steps.paths.outputs.mv3_name }}
           path: ${{ steps.paths.outputs.mv3_path }}
 
       - name: Upload to latest release
         if: github.event.inputs.dry_run != 'true'
-        uses: svenstaro/upload-release-action@v2
+        uses: svenstaro/upload-release-action@ac75e1407b33421f1368f08e0e6cc567cc4edd25  # 2.11.5
         with:
           repo_token: ${{ secrets.GITHUB_TOKEN }}
           file: .output/*mv*.zip