diff --git a/.github/workflows/publish-aur.yml b/.github/workflows/publish-aur.yml
index 4ab6db89ab703..9ff2adb26a52d 100644
--- a/.github/workflows/publish-aur.yml
+++ b/.github/workflows/publish-aur.yml
@@ -48,7 +48,7 @@ jobs:
         run: pacman -Syu --noconfirm --needed git github-cli jq namcap openssh sudo
 
       - name: Checkout packaging sources
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Create unprivileged build user
         run: |
diff --git a/.github/workflows/windows-tests.yml b/.github/workflows/windows-tests.yml
index 3a70ad5a26a05..77716a5cdf922 100644
--- a/.github/workflows/windows-tests.yml
+++ b/.github/workflows/windows-tests.yml
@@ -30,7 +30,7 @@ jobs:
     timeout-minutes: 45
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           sparse-checkout: |
             /*
@@ -40,7 +40,7 @@ jobs:
       # setup-vp's own cache restores a Linux-shaped store on Windows, which is
       # slower than no cache (see #7975). Cache pnpm's Windows store directly.
       - name: Setup Vite+
-        uses: voidzero-dev/setup-vp@v1
+        uses: voidzero-dev/setup-vp@250f29ce396baf5e8f24498e17c0dfdebabc26eb # v1
         with:
           node-version-file: package.json
           cache: false
@@ -52,7 +52,7 @@ jobs:
         run: '"path=$(vp pm cache dir)" >> $env:GITHUB_OUTPUT'
 
       - name: Cache packages
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: ${{ steps.package_cache_path.outputs.path }}
           key: windows-tests-packages-v1-${{ hashFiles('pnpm-lock.yaml') }}