diff --git a/.github/workflows/benchmarks.yml b/.github/workflows/benchmarks.yml
index d2321f9d..940c58ae 100644
--- a/.github/workflows/benchmarks.yml
+++ b/.github/workflows/benchmarks.yml
@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: "Checkout"
-        uses: "actions/checkout@v3"
+        uses: "actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26" # v3
 
       - name: "Install PHP"
         uses: "shivammathur/setup-php@v2"
@@ -32,7 +32,7 @@ jobs:
           tools: composer:v2, cs2pr
 
       - name: "Cache dependencies"
-        uses: "actions/cache@v3"
+        uses: "actions/cache@6f8efc29b200d32929f49075959781ed54ec270c" # v3
         with:
           path: |
             ~/.composer/cache
diff --git a/.github/workflows/coding-standards.yml b/.github/workflows/coding-standards.yml
index abbcb1d1..51355be0 100644
--- a/.github/workflows/coding-standards.yml
+++ b/.github/workflows/coding-standards.yml
@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: "Checkout"
-        uses: "actions/checkout@v3"
+        uses: "actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26" # v3
 
       - name: "Install PHP"
         uses: "shivammathur/setup-php@v2"
@@ -32,7 +32,7 @@ jobs:
           tools: composer:v2, cs2pr
 
       - name: "Cache dependencies"
-        uses: "actions/cache@v3"
+        uses: "actions/cache@6f8efc29b200d32929f49075959781ed54ec270c" # v3
         with:
           path: |
             ~/.composer/cache
diff --git a/.github/workflows/demo-scripts.yml b/.github/workflows/demo-scripts.yml
index 90c14c03..9dbc1598 100644
--- a/.github/workflows/demo-scripts.yml
+++ b/.github/workflows/demo-scripts.yml
@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: "Checkout"
-        uses: "actions/checkout@v3"
+        uses: "actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26" # v3
 
       - name: "Install PHP"
         uses: "shivammathur/setup-php@v2"
@@ -32,7 +32,7 @@ jobs:
           tools: composer:v2, cs2pr
 
       - name: "Cache dependencies"
-        uses: "actions/cache@v3"
+        uses: "actions/cache@6f8efc29b200d32929f49075959781ed54ec270c" # v3
         with:
           path: |
             ~/.composer/cache
diff --git a/.github/workflows/mutation-tests.yml b/.github/workflows/mutation-tests.yml
index 3004c15a..cde0e54c 100644
--- a/.github/workflows/mutation-tests.yml
+++ b/.github/workflows/mutation-tests.yml
@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: "Checkout"
-        uses: "actions/checkout@v3"
+        uses: "actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26" # v3
 
       - name: "Install PHP"
         uses: "shivammathur/setup-php@v2"
@@ -32,7 +32,7 @@ jobs:
           tools: composer:v2, cs2pr
 
       - name: "Cache dependencies"
-        uses: "actions/cache@v3"
+        uses: "actions/cache@6f8efc29b200d32929f49075959781ed54ec270c" # v3
         with:
           path: |
             ~/.composer/cache
diff --git a/.github/workflows/phpunit.yml b/.github/workflows/phpunit.yml
index 996fef19..624fafa7 100644
--- a/.github/workflows/phpunit.yml
+++ b/.github/workflows/phpunit.yml
@@ -27,7 +27,7 @@ jobs:
 
     steps:
       - name: "Checkout"
-        uses: "actions/checkout@v3"
+        uses: "actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26" # v3
 
       - name: "Install PHP"
         uses: "shivammathur/setup-php@v2"
@@ -38,7 +38,7 @@ jobs:
           tools: composer:v2, cs2pr
 
       - name: "Cache dependencies"
-        uses: "actions/cache@v3"
+        uses: "actions/cache@6f8efc29b200d32929f49075959781ed54ec270c" # v3
         with:
           path: |
             ~/.composer/cache
diff --git a/.github/workflows/psalm.yml b/.github/workflows/psalm.yml
index 03bbedd9..f52252b5 100644
--- a/.github/workflows/psalm.yml
+++ b/.github/workflows/psalm.yml
@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: "Checkout"
-        uses: "actions/checkout@v3"
+        uses: "actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26" # v3
 
       - name: "Install PHP"
         uses: "shivammathur/setup-php@v2"
@@ -32,7 +32,7 @@ jobs:
           tools: composer:v2, cs2pr
 
       - name: "Cache dependencies"
-        uses: "actions/cache@v3"
+        uses: "actions/cache@6f8efc29b200d32929f49075959781ed54ec270c" # v3
         with:
           path: |
             ~/.composer/cache
diff --git a/.github/workflows/release-on-milestone-closed.yml b/.github/workflows/release-on-milestone-closed.yml
index caec7560..ff303071 100644
--- a/.github/workflows/release-on-milestone-closed.yml
+++ b/.github/workflows/release-on-milestone-closed.yml
@@ -14,10 +14,10 @@ jobs:
 
     steps:
       - name: "Checkout"
-        uses: "actions/checkout@v3"
+        uses: "actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26" # v3
 
       - name: "Release"
-        uses: "laminas/automatic-releases@v1"
+        uses: "laminas/automatic-releases@98204e32a52de981e1d75622d0d89a9520b6e87a" # v1
         with:
           command-name: "laminas:automatic-releases:release"
         env:
@@ -27,7 +27,7 @@ jobs:
           "GIT_AUTHOR_EMAIL": ${{ secrets.GIT_AUTHOR_EMAIL }}
 
       - name: "Create Merge-Up Pull Request"
-        uses: "laminas/automatic-releases@v1"
+        uses: "laminas/automatic-releases@98204e32a52de981e1d75622d0d89a9520b6e87a" # v1
         with:
           command-name: "laminas:automatic-releases:create-merge-up-pull-request"
         env:
@@ -37,7 +37,7 @@ jobs:
           "GIT_AUTHOR_EMAIL": ${{ secrets.GIT_AUTHOR_EMAIL }}
 
       - name: "Create and/or Switch to new Release Branch"
-        uses: "laminas/automatic-releases@v1"
+        uses: "laminas/automatic-releases@98204e32a52de981e1d75622d0d89a9520b6e87a" # v1
         with:
           command-name: "laminas:automatic-releases:switch-default-branch-to-next-minor"
         env:
@@ -47,7 +47,7 @@ jobs:
           "GIT_AUTHOR_EMAIL": ${{ secrets.GIT_AUTHOR_EMAIL }}
 
       - name: "Bump Changelog Version On Originating Release Branch"
-        uses: "laminas/automatic-releases@v1"
+        uses: "laminas/automatic-releases@98204e32a52de981e1d75622d0d89a9520b6e87a" # v1
         with:
           command-name: "laminas:automatic-releases:bump-changelog"
         env: