diff --git a/.github/workflows/node-pretest.yml b/.github/workflows/node-pretest.yml
index 48c68f5955..4216ab3700 100644
--- a/.github/workflows/node-pretest.yml
+++ b/.github/workflows/node-pretest.yml
@@ -19,7 +19,7 @@ jobs:
 
     steps:
       - uses: actions/checkout@v2
-      - uses: ljharb/actions/node/install@main
+      - uses: ljharb/actions/node/install@46bd9bc79196ec7b5c336b66bc3f5d99c6d2e828 # main
         name: 'nvm install lts/* && npm install'
         with:
           node-version: 'lts/*'
diff --git a/.github/workflows/node.yml b/.github/workflows/node.yml
index 6fc77ea08d..72350fd316 100644
--- a/.github/workflows/node.yml
+++ b/.github/workflows/node.yml
@@ -8,7 +8,7 @@ jobs:
     outputs:
       latest: ${{ steps.set-matrix.outputs.requireds }}
     steps:
-      - uses: ljharb/actions/node/matrix@main
+      - uses: ljharb/actions/node/matrix@46bd9bc79196ec7b5c336b66bc3f5d99c6d2e828 # main
         id: set-matrix
         with:
           versionsAsRoot: true
@@ -40,7 +40,7 @@ jobs:
 
     steps:
       - uses: actions/checkout@v2
-      - uses: ljharb/actions/node/install@main
+      - uses: ljharb/actions/node/install@46bd9bc79196ec7b5c336b66bc3f5d99c6d2e828 # main
         name: 'nvm install ${{ matrix.node-version }} && npm install'
         with:
           before_install: cd "packages/${{ matrix.package }}"
@@ -50,7 +50,7 @@ jobs:
       - run: node -pe "require('eslint/package.json').version"
         name: 'eslint version'
       - run: npm run travis
-      - uses: codecov/codecov-action@v2
+      - uses: codecov/codecov-action@f32b3a3741e1053eb607407145bc9619351dc93b # v2
 
   react:
     needs: [matrix]
@@ -75,7 +75,7 @@ jobs:
 
     steps:
       - uses: actions/checkout@v2
-      - uses: ljharb/actions/node/install@main
+      - uses: ljharb/actions/node/install@46bd9bc79196ec7b5c336b66bc3f5d99c6d2e828 # main
         name: 'nvm install ${{ matrix.node-version }} && npm install'
         with:
           before_install: cd "packages/${{ matrix.package }}"
@@ -87,7 +87,7 @@ jobs:
       - run: npm install --no-save "eslint-plugin-react-hooks@${{ matrix.react-hooks }}"
         if: ${{ matrix.react-hooks > 0}}
       - run: npm run travis
-      - uses: codecov/codecov-action@v2
+      - uses: codecov/codecov-action@f32b3a3741e1053eb607407145bc9619351dc93b # v2
 
   prepublish-base:
     name: 'prepublish tests (base config)'
@@ -107,7 +107,7 @@ jobs:
 
     steps:
       - uses: actions/checkout@v2
-      - uses: ljharb/actions/node/install@main
+      - uses: ljharb/actions/node/install@46bd9bc79196ec7b5c336b66bc3f5d99c6d2e828 # main
         name: 'nvm install lts/* && npm install'
         with:
           before_install: cd "packages/${{ matrix.package }}"
@@ -140,7 +140,7 @@ jobs:
 
     steps:
       - uses: actions/checkout@v2
-      - uses: ljharb/actions/node/install@main
+      - uses: ljharb/actions/node/install@46bd9bc79196ec7b5c336b66bc3f5d99c6d2e828 # main
         name: 'nvm install lts/* && npm install'
         with:
           before_install: cd "packages/${{ matrix.package }}"
diff --git a/.github/workflows/rebase.yml b/.github/workflows/rebase.yml
index 027aed0797..6a86619ad9 100644
--- a/.github/workflows/rebase.yml
+++ b/.github/workflows/rebase.yml
@@ -10,6 +10,6 @@ jobs:
 
     steps:
     - uses: actions/checkout@v2
-    - uses: ljharb/rebase@master
+    - uses: ljharb/rebase@c6bd0a72b14dfaf76ad6a070029c8b4592d03eea # master
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/require-allow-edits.yml b/.github/workflows/require-allow-edits.yml
index 549d7b4823..e6cd73fd71 100644
--- a/.github/workflows/require-allow-edits.yml
+++ b/.github/workflows/require-allow-edits.yml
@@ -9,4 +9,4 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: ljharb/require-allow-edits@main
+    - uses: ljharb/require-allow-edits@13f90bc8cc5de000f2b44a0e2c3a11d108e8cd9f # main