diff --git a/.github/workflows/branch-delete.yml b/.github/workflows/branch-delete.yml
index 5cf3849..97acd67 100644
--- a/.github/workflows/branch-delete.yml
+++ b/.github/workflows/branch-delete.yml
@@ -25,7 +25,7 @@ jobs:
            echo "branch=${branch}" >> $GITHUB_OUTPUT
 
       - name: Neon Database Delete Branch
-        uses: neondatabase/delete-branch-action@v3.1.3
+        uses: neondatabase/delete-branch-action@700b304727db5c1a61ac3ef16d0a89f676e7f303 # v3.1.3
         with:
           project_id: ${{ secrets.NEON_PROJECT_ID }}
           branch: ${{ steps.get_branch.outputs.branch }}
diff --git a/.github/workflows/chromatic.yml b/.github/workflows/chromatic.yml
index bdb19d0..2777414 100644
--- a/.github/workflows/chromatic.yml
+++ b/.github/workflows/chromatic.yml
@@ -13,18 +13,18 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4
         with:
           node-version-file: "package.json"
           cache: "npm"
       - run: npm ci
 
       - name: Publish to Chromatic
-        uses: chromaui/action@v10
+        uses: chromaui/action@24e115aa107a595a2e98d6df99a418c388818c54 # v10
         with:
           projectToken: ${{ secrets.CHROMATIC_PROJECT_TOKEN }}
           exitOnceUploaded: true
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e8010c9..0e53e4e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,8 +16,8 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+      - uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4
         with:
           node-version-file: "package.json"
           cache: "npm"
@@ -30,8 +30,8 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+      - uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4
         with:
           node-version-file: "package.json"
           cache: "npm"
@@ -52,8 +52,8 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+      - uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4
         with:
           node-version-file: "package.json"
           cache: "npm"
@@ -61,7 +61,7 @@ jobs:
       - name: Install Playwright Browsers
         run: npx playwright install --with-deps
       - name: Waiting for 200 OK from the Vercel Preview
-        uses: patrickedqvist/wait-for-vercel-preview@v1.3.1
+        uses: patrickedqvist/wait-for-vercel-preview@dca4940010f36d2d44caa487087a09b57939b24a # v1.3.1
         id: waitForDeploy
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -70,7 +70,7 @@ jobs:
         run: npm run e2e
         env:
           VERCEL_URL: ${{ steps.waitForDeploy.outputs.url }}
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392 # v4
         if: always()
         with:
           name: playwright-report
diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml
index ed2632c..e077874 100644
--- a/.github/workflows/commitlint.yml
+++ b/.github/workflows/commitlint.yml
@@ -11,7 +11,7 @@ jobs:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4
         with:
           node-version-file: "package.json"
           cache: "npm"
diff --git a/.github/workflows/gitattributes.yml b/.github/workflows/gitattributes.yml
index 15591c5..9ecd7da 100644
--- a/.github/workflows/gitattributes.yml
+++ b/.github/workflows/gitattributes.yml
@@ -12,7 +12,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Make check-gitattributes.sh executable
         run: chmod +x check-gitattributes.sh
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 0175443..6ee701e 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -35,7 +35,7 @@ jobs:
         working-directory: docs
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
       - name: Setup Ruby
         uses: ruby/setup-ruby@v1
         with:
@@ -44,7 +44,7 @@ jobs:
           working-directory: "${{ github.workspace }}/docs"
       - name: Setup Pages
         id: pages
-        uses: actions/configure-pages@v4
+        uses: actions/configure-pages@1f0c5cde4bc74cd7e1254d0cb4de8d49e9068c7d # v4
       - name: Build with Jekyll
         # Outputs to the './_site' directory by default
         run: bundle exec jekyll build --baseurl "${{ steps.pages.outputs.base_path }}"
diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml
index 7678e56..709f413 100644
--- a/.github/workflows/preview.yml
+++ b/.github/workflows/preview.yml
@@ -13,7 +13,7 @@ jobs:
   delete:
     runs-on: ubuntu-latest
     steps:
-      - uses: snaplet/vercel-action@v3.0.1
+      - uses: snaplet/vercel-action@a84e8e02e05dc563cb94bf816c04a8c6d135571f # v3.0.1
         with:
           delete: true
           ignored-build-command: ""