diff --git a/.github/workflows/backend.yml b/.github/workflows/backend.yml
index e49772b..675c077 100644
--- a/.github/workflows/backend.yml
+++ b/.github/workflows/backend.yml
@@ -19,7 +19,7 @@ jobs:
     env:
       DFX_VERSION: 0.7.0-beta.6
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
     - name: Install
       run: |
         echo y | DFX_VERSION=$DFX_VERSION bash -ci "$(curl -fsSL https://sdk.dfinity.org/install.sh)"
diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml
index e4d446a..a4c8bfe 100644
--- a/.github/workflows/build-and-test.yml
+++ b/.github/workflows/build-and-test.yml
@@ -19,9 +19,9 @@ jobs:
     env:
       DFX_VERSION: 0.7.0-beta.6
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
     - name: Setup Node.js environment
-      uses: actions/setup-node@v2
+      uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2.5.2
       with:
         node-version: "12"
     - name: Install
@@ -59,14 +59,14 @@ jobs:
         dfx stop
 
     - name: Upload e2e videos artifact
-      uses: actions/upload-artifact@v2
+      uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2 # v2.3.1
       if: failure()
       with:
         name: failed-e2e-files
         path: ~/work/cancan-archived/cancan-archived/e2e/cypress/videos/*.mp4
 
     - name: Upload failed files artifact
-      uses: actions/upload-artifact@v2
+      uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2 # v2.3.1
       if: failure()
       with:
         name: fail-build