diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index af17311..e43852b 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -26,7 +26,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
       - id: dsv
         # If using as a template outside of the actual repo, you sould reference like this instead:
         # uses: DelineaXPM/dsv-github-action@v1 # renovate: tag=v1
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6e49e09..e07fc4c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
       # https://github.com/magnetikonline/action-golang-cache
       - name: Setup Golang with cache
@@ -23,17 +23,17 @@ jobs:
           go-version-file: go.mod
 
       - name: mage-tidy
-        uses: magefile/mage-action@3b833fb24c0d19eed3aa760b9eb285b4b84f420f # v2
+        uses: magefile/mage-action@a3d5bb52942181c125118a2be4b4664c3337aef6 # v2
         with:
           version: latest
           args: init
       - name: docker-login
-        uses: docker/login-action@v2 # renovate: tag=v2
+        uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2
         with:
           username: ${{ secrets.DSV_DOCKER_USERNAME }}
           password: ${{ secrets.DSV_DOCKER_PASSWORD }}
       - name: mage-release
-        uses: magefile/mage-action@3b833fb24c0d19eed3aa760b9eb285b4b84f420f # v2
+        uses: magefile/mage-action@a3d5bb52942181c125118a2be4b4664c3337aef6 # v2
         with:
           version: latest
           args: release