diff --git a/.github/workflows/github-release.yaml b/.github/workflows/github-release.yaml
index 9537722..5ae7c08 100644
--- a/.github/workflows/github-release.yaml
+++ b/.github/workflows/github-release.yaml
@@ -8,7 +8,7 @@ on:
 jobs:
   release:
     if: github.event.pull_request.merged == true && !contains(github.event.pull_request.title, 'skip-release')
-    uses: libops/actions/.github/workflows/bump-release.yaml@main
+    uses: libops/actions/.github/workflows/bump-release.yaml@ef667db8c16533a257d841e75df5c3388152b2d7 # main
     with:
       workflow_file: goreleaser.yaml
       prefix: v
diff --git a/.github/workflows/goreleaser.yaml b/.github/workflows/goreleaser.yaml
index c28c709..6f42777 100644
--- a/.github/workflows/goreleaser.yaml
+++ b/.github/workflows/goreleaser.yaml
@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   goreleaser:
-    uses: libops/terraform-linux-packages/.github/workflows/reusable-goreleaser.yaml@main
+    uses: libops/terraform-linux-packages/.github/workflows/reusable-goreleaser.yaml@4a8eafe5a90d5f811e389d2d55015287896c2a66 # main
     permissions:
       contents: write
       id-token: write
diff --git a/.github/workflows/lint-test.yaml b/.github/workflows/lint-test.yaml
index f25cac0..a891c4f 100644
--- a/.github/workflows/lint-test.yaml
+++ b/.github/workflows/lint-test.yaml
@@ -11,7 +11,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Set up Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version: ">=1.26.1"