diff --git a/.github/workflows/continuous-deployment.yml b/.github/workflows/continuous-deployment.yml
index 79674ad..614446c 100644
--- a/.github/workflows/continuous-deployment.yml
+++ b/.github/workflows/continuous-deployment.yml
@@ -15,14 +15,14 @@ jobs:
 
     steps:
       - name: "Checkout"
-        uses: "actions/checkout@v2"
+        uses: "actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5" # v2
         
       - name: "Get upload_url"
         run: echo "::set-output name=upload_url::https://uploads.github.com/repos/$GITHUB_REPOSITORY/releases/$(jq --raw-output '.release.id' $GITHUB_EVENT_PATH)/assets{?name,label}"  
         id: release
 
       - name: "Upload cs2pr"
-        uses: "actions/upload-release-asset@v1"
+        uses: "actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5" # v1
         env:
           GITHUB_TOKEN: ${{ secrets.STAABM_TOKEN }}
         with:
diff --git a/.github/workflows/continuous-integration.yml b/.github/workflows/continuous-integration.yml
index 5d2edfc..ca4c2d7 100644
--- a/.github/workflows/continuous-integration.yml
+++ b/.github/workflows/continuous-integration.yml
@@ -16,10 +16,10 @@ jobs:
 
     steps:
       - name: "Checkout"
-        uses: "actions/checkout@v2"
+        uses: "actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5" # v2
 
       - name: "Install PHP with extensions"
-        uses: "shivammathur/setup-php@v2"
+        uses: "shivammathur/setup-php@c77c69f5c8897d89fe313f4b6dd4d768d6a1b3db" # v2
         with:
           coverage: "none"
           extensions: "simplexml"
@@ -54,10 +54,10 @@ jobs:
 
     steps:
       - name: "Checkout"
-        uses: "actions/checkout@v2"
+        uses: "actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5" # v2
 
       - name: "Install PHP with extensions"
-        uses: "shivammathur/setup-php@v2"
+        uses: "shivammathur/setup-php@c77c69f5c8897d89fe313f4b6dd4d768d6a1b3db" # v2
         with:
           coverage: "none"
           extensions: "simplexml"
diff --git a/.github/workflows/csfix.yml b/.github/workflows/csfix.yml
index 54169ed..ffbfb9b 100644
--- a/.github/workflows/csfix.yml
+++ b/.github/workflows/csfix.yml
@@ -13,12 +13,12 @@ jobs:
     if: github.event.pull_request.head.repo.full_name == github.repository
     
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
       with:
         ref: ${{ github.head_ref }}
 
     - name: Setup PHP
-      uses: shivammathur/setup-php@v2
+      uses: shivammathur/setup-php@c77c69f5c8897d89fe313f4b6dd4d768d6a1b3db # v2
       with:
         php-version: 7.0
         coverage: none # disable xdebug, pcov
@@ -30,7 +30,7 @@ jobs:
     - name: "Run friendsofphp/php-cs-fixer"
       run: "vendor/bin/php-cs-fixer fix --config=.php_cs --diff --diff-format=udiff --verbose"
 
-    - uses: stefanzweifel/git-auto-commit-action@v2.5.0
+    - uses: stefanzweifel/git-auto-commit-action@6d7a33192ef1f82f6e4141bc1199880a4651ec13 # v2.5.0
       with:
         commit_message: Apply php-cs-fixer changes
         branch: ${{ github.head_ref }}
diff --git a/.github/workflows/php-linter.yml b/.github/workflows/php-linter.yml
index 337abcd..4777aba 100644
--- a/.github/workflows/php-linter.yml
+++ b/.github/workflows/php-linter.yml
@@ -13,13 +13,13 @@ jobs:
     if: github.event.pull_request.draft == false
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
         with:
           repository: ${{ github.event.client_payload.pull_request.head.repo.full_name }}
           ref: ${{ github.event.client_payload.pull_request.head.ref }}
 
       -   name: Setup PHP
-          uses: shivammathur/setup-php@v2
+          uses: shivammathur/setup-php@c77c69f5c8897d89fe313f4b6dd4d768d6a1b3db # v2
           with:
             php-version: 7.4
             coverage: none # disable xdebug, pcov