diff --git a/.github/workflows/asf-allowlist-check.yml b/.github/workflows/asf-allowlist-check.yml
index 17dca76e5f9a..a6a146bdebc0 100644
--- a/.github/workflows/asf-allowlist-check.yml
+++ b/.github/workflows/asf-allowlist-check.yml
@@ -33,7 +33,7 @@ jobs:
   asf-allowlist-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
       - uses: apache/infrastructure-actions/allowlist-check@main
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ce19d8232fce..61507b78d887 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -35,9 +35,9 @@ jobs:
     name: 'macOS (JDK 21)'
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
       - name: 'Set up JDK 21'
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
         with:
             java-version: '21'
             distribution: temurin
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index e3c0052c87ae..7a3f6ba6438b 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -38,7 +38,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
 
diff --git a/.github/workflows/docker-images.yml b/.github/workflows/docker-images.yml
index 992a0ea5ac90..ff0748eeffaf 100644
--- a/.github/workflows/docker-images.yml
+++ b/.github/workflows/docker-images.yml
@@ -64,10 +64,10 @@ jobs:
           df -h
 
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
       - name: 'Set up JDK 21'
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
         with:
           java-version: '21'
           distribution: temurin
diff --git a/.github/workflows/hive-postgres-tpcds-metastore.yml b/.github/workflows/hive-postgres-tpcds-metastore.yml
index db4a62ad8092..dcc778c80f1d 100644
--- a/.github/workflows/hive-postgres-tpcds-metastore.yml
+++ b/.github/workflows/hive-postgres-tpcds-metastore.yml
@@ -36,7 +36,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index dd07016d75a1..125623ca7c44 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -28,7 +28,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/stale@v3
+    - uses: actions/stale@98ed4cb500039dbcccf4bd9bedada4d0187f2757 # v3
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         stale-pr-message: This pull request has been automatically marked as