diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 605cbb229..141f243a5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -97,7 +97,7 @@ jobs:
     name: shared-library
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/rust-ci.yml@1ab6708b62ec7bd17f2d8a519c6fcc39edb22243
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/rust-ci.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23
     with:
       working_directory: libs/hbb_common
       test_matrix_os: '["ubuntu-latest", "macos-latest"]'
@@ -110,7 +110,7 @@ jobs:
     name: actionlint
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/actionlint.yml@9231ee7421354867b0fe0e019c4e20dcce5d05e7
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/actionlint.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23
 
   pr-hygiene:
     name: pr-hygiene
@@ -119,7 +119,7 @@ jobs:
       contents: read
       issues: write # the stale bot closes threads
       pull-requests: write # the labeler applies labels
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/pr-hygiene.yml@1ab6708b62ec7bd17f2d8a519c6fcc39edb22243
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/pr-hygiene.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23
     with:
       # The stock configuration rejects any body line over 100 characters, and
       # Dependabot writes a 144-character compare link into every git-ref bump.
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 7c512699a..0d53d2d65 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -24,7 +24,7 @@ jobs:
       actions: read # CodeQL reads the workflow definitions it analyses
       contents: read
       security-events: write # CodeQL publishes its findings to code scanning
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@9231ee7421354867b0fe0e019c4e20dcce5d05e7
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23
     with:
       # Actions only, and both absences are stated rather than implied.
       #
@@ -46,7 +46,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write # writes the review it produces
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-dependency-review.yml@9231ee7421354867b0fe0e019c4e20dcce5d05e7
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-dependency-review.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23
     with:
       fail_on_severity: moderate
 
@@ -58,7 +58,7 @@ jobs:
       contents: read
       id-token: write # mints the OIDC token its publication is signed with
       security-events: write # Scorecard publishes its findings to code scanning
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-scorecard.yml@9231ee7421354867b0fe0e019c4e20dcce5d05e7
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-scorecard.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23
 
   # There is no `osv` job, and the absence is the honest answer rather than an
   # oversight.
@@ -85,10 +85,10 @@ jobs:
       actions: read # the SARIF upload reads this run to attach its results
       contents: read
       security-events: write # zizmor publishes its findings to code scanning
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/zizmor-sarif.yml@9231ee7421354867b0fe0e019c4e20dcce5d05e7
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/zizmor-sarif.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23
 
   secret-scan:
     name: secret-scan
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/secret-scan.yml@1ab6708b62ec7bd17f2d8a519c6fcc39edb22243
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/secret-scan.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23