diff --git a/.github/workflows/markdown-check-format.yml b/.github/workflows/markdown-check-format.yml
index a21eb85e..3b230534 100644
--- a/.github/workflows/markdown-check-format.yml
+++ b/.github/workflows/markdown-check-format.yml
@@ -11,7 +11,7 @@ jobs:
   markdown-check-format:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
         with:
           fetch-depth: 0
       - run: |
diff --git a/tools/dependency-scan/github-workflow-action-generate-sbom.yml b/tools/dependency-scan/github-workflow-action-generate-sbom.yml
index 13d2096f..dee43327 100644
--- a/tools/dependency-scan/github-workflow-action-generate-sbom.yml
+++ b/tools/dependency-scan/github-workflow-action-generate-sbom.yml
@@ -9,12 +9,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@master
-    - uses: anchore/sbom-action@v0
+    - uses: anchore/sbom-action@f6c3d0fe42c3cf876e3462574e4c9416b5e0f07a #v0.9.0
       with:
         path: ./
         format: cyclonedx-json
         artifact-name: sbom-repo.cdx.json
-    - uses: anchore/sbom-action@v0
+    - uses: anchore/sbom-action@f6c3d0fe42c3cf876e3462574e4c9416b5e0f07a #v0.9.0
       with:
         image: my-registry.com/my/awesome/image
         registry-username: ${{ secrets.REGISTRY_USERNAME }}
diff --git a/tools/dependency-scan/github-workflow-action-scan-vulnerabilities.yml b/tools/dependency-scan/github-workflow-action-scan-vulnerabilities.yml
index 1ab2e453..c6b09191 100644
--- a/tools/dependency-scan/github-workflow-action-scan-vulnerabilities.yml
+++ b/tools/dependency-scan/github-workflow-action-scan-vulnerabilities.yml
@@ -8,13 +8,13 @@ jobs:
   scan-vulnerabilities:
     runs-on: ubuntu-latest
     steps:
-    - uses: anchore/scan-action@v3
+    - uses: anchore/scan-action@8576240a41341d866dbd7ebc72cd9fc0ef023f54 #v7.4.2
       with:
         sbom: sbom-repo.cdx.json
         fail-build: true
         severity-cutoff: critical
         acs-report-enable: true
-    - uses: anchore/scan-action@v3
+    - uses: anchore/scan-action@8576240a41341d866dbd7ebc72cd9fc0ef023f54 #v7.4.2
       with:
         sbom: sbom-image.cdx.json
         fail-build: true