diff --git a/.github/workflows/back-merge-handler.yml b/.github/workflows/back-merge-handler.yml
index 0346f03..9c11220 100644
--- a/.github/workflows/back-merge-handler.yml
+++ b/.github/workflows/back-merge-handler.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.ref_name == 'master'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
 
@@ -49,7 +49,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.ref_name == 'stable'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/back-merge.yaml b/.github/workflows/back-merge.yaml
index d8dac13..37f44cd 100644
--- a/.github/workflows/back-merge.yaml
+++ b/.github/workflows/back-merge.yaml
@@ -8,7 +8,7 @@ on:
 
 jobs:
   back-merge:
-    uses: regulaforensics/reusable-workflows/.github/workflows/back-merge.yaml@main
+    uses: regulaforensics/reusable-workflows/.github/workflows/back-merge.yaml@f9848fa9ec1ae1e6285b56200ac1f24fbfaee0c3 # main
     with:
       source_branch: ${{ github.ref_name }}
       merge_pairs: "master:stable,stable:develop"
diff --git a/.github/workflows/run-example-on-test-api.yml b/.github/workflows/run-example-on-test-api.yml
index df6374e..6b52f9e 100644
--- a/.github/workflows/run-example-on-test-api.yml
+++ b/.github/workflows/run-example-on-test-api.yml
@@ -12,9 +12,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4
         with:
           distribution: 'zulu'
           java-version: 11