diff --git a/.github/actions/gradle-task-with-commit/action.yml b/.github/actions/gradle-task-with-commit/action.yml
index d1ddc76a29..8db4db8c75 100644
--- a/.github/actions/gradle-task-with-commit/action.yml
+++ b/.github/actions/gradle-task-with-commit/action.yml
@@ -75,7 +75,7 @@ runs:
 
     - name: commit ${{ inputs.fix-task }} changes
       if: steps.can-push.outputs.can_push == 'true'
-      uses: stefanzweifel/git-auto-commit-action@v6
+      uses: stefanzweifel/git-auto-commit-action@778341af668090896ca464160c2def5d1d1a3eb0 # v6
       with:
         commit_message: ${{ steps.set-commit-message.outputs.commit-message }}
         commit_options: '--no-verify --signoff'
diff --git a/.github/workflows/kotlin.yml b/.github/workflows/kotlin.yml
index 4bca42dd8b..ea5e85fb6a 100644
--- a/.github/workflows/kotlin.yml
+++ b/.github/workflows/kotlin.yml
@@ -50,7 +50,7 @@ jobs:
       # We use the workflow-pr-fixer app to authenticate and get a token that will cause the workflow
       # to be triggered again.
       - name: Generate App Token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2
         id: app-token
         with:
           app-id: ${{ vars.APP_ID }}
@@ -74,7 +74,7 @@ jobs:
       # We use the workflow-pr-fixer app to authenticate and get a token that will cause the workflow
       # to be triggered again.
       - name: Generate App Token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2
         id: app-token
         with:
           app-id: ${{ vars.APP_ID }}
@@ -97,7 +97,7 @@ jobs:
       # We use the workflow-pr-fixer app to authenticate and get a token that will cause the workflow
       # to be triggered again.
       - name: Generate App Token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2
         id: app-token
         with:
           app-id: ${{ vars.APP_ID }}
@@ -122,7 +122,7 @@ jobs:
       # We use the workflow-pr-fixer app to authenticate and get a token that will cause the workflow
       # to be triggered again.
       - name: Generate App Token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2
         id: app-token
         with:
           app-id: ${{ vars.APP_ID }}
@@ -147,7 +147,7 @@ jobs:
       # We use the workflow-pr-fixer app to authenticate and get a token that will cause the workflow
       # to be triggered again.
       - name: Generate App Token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2
         id: app-token
         with:
           app-id: ${{ vars.APP_ID }}
diff --git a/.github/workflows/validate-documentation.yml b/.github/workflows/validate-documentation.yml
index dc18d9d9c8..2dba3d1d69 100644
--- a/.github/workflows/validate-documentation.yml
+++ b/.github/workflows/validate-documentation.yml
@@ -16,7 +16,7 @@ jobs:
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - name: Set up Ruby 2.6
-        uses: ruby/setup-ruby@v1.229.0
+        uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1.229.0
         with:
           ruby-version: 3.4.2
       - name: Install dependencies