diff --git a/.github/workflows/auto-approve.yml b/.github/workflows/auto-approve.yml
index c6319d36ca..35934d5e3b 100644
--- a/.github/workflows/auto-approve.yml
+++ b/.github/workflows/auto-approve.yml
@@ -9,7 +9,7 @@ jobs:
     if: "! startsWith(github.event.head_commit.message, '[CI Skip]') && (!github.event.pull_request || github.event.pull_request.head.repo.full_name == github.repository)"
     runs-on: ubuntu-latest
     steps:
-      - uses: jacogr/action-approve@master
+      - uses: jacogr/action-approve@9d6ce78d26f23ad29d009d034822cf773f2cb50e
         with:
           authors: jacogr
           labels: -auto
diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml
index 6b5b10c98c..cd3b7fc5da 100644
--- a/.github/workflows/auto-merge.yml
+++ b/.github/workflows/auto-merge.yml
@@ -8,7 +8,7 @@ jobs:
   merge:
     runs-on: ubuntu-latest
     steps:
-      - uses: jacogr/action-merge@master
+      - uses: jacogr/action-merge@3b4b49af8a8644bf5cbb5409ee236abe04eeb1b0
         with:
           checks: build:code,build:i18n,build:electron,lint,test
           labels: -auto
diff --git a/.github/workflows/chain-endpoints.yml b/.github/workflows/chain-endpoints.yml
index 5e1157c33f..b8af28720d 100644
--- a/.github/workflows/chain-endpoints.yml
+++ b/.github/workflows/chain-endpoints.yml
@@ -7,7 +7,7 @@ jobs:
   types:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@7884fcad6b5d53d10323aee724dc68d8b9096a2e
     - name: check
       env:
         CI_LOG: 123
diff --git a/.github/workflows/chain-types.yml b/.github/workflows/chain-types.yml
index bf3d706a75..9ec21dce8a 100644
--- a/.github/workflows/chain-types.yml
+++ b/.github/workflows/chain-types.yml
@@ -7,7 +7,7 @@ jobs:
   types:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@7884fcad6b5d53d10323aee724dc68d8b9096a2e
     - name: check
       env:
         CI_LOG: 123
diff --git a/.github/workflows/lock.yml b/.github/workflows/lock.yml
index 6438c19275..42d0f6769a 100644
--- a/.github/workflows/lock.yml
+++ b/.github/workflows/lock.yml
@@ -8,7 +8,7 @@ jobs:
   lock:
     runs-on: ubuntu-latest
     steps:
-      - uses: dessant/lock-threads@v2
+      - uses: dessant/lock-threads@f1a42f0f44eb83361d617a014663e1a76cf282d2
         with:
           github-token: ${{ secrets.GH_PAT_BOT }}
           issue-lock-inactive-days: '7'
diff --git a/.github/workflows/pr-any.yml b/.github/workflows/pr-any.yml
index f7a764a107..7676ebb4c1 100644
--- a/.github/workflows/pr-any.yml
+++ b/.github/workflows/pr-any.yml
@@ -9,7 +9,7 @@ jobs:
     name: ${{ matrix.step }}
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@7884fcad6b5d53d10323aee724dc68d8b9096a2e
     - name: ${{ matrix.step }}
       run: |
         yarn install --immutable | grep -v 'YN0013'
diff --git a/.github/workflows/push-master.yml b/.github/workflows/push-master.yml
index 872c83269d..8501ca00c5 100644
--- a/.github/workflows/push-master.yml
+++ b/.github/workflows/push-master.yml
@@ -14,7 +14,7 @@ jobs:
     name: ${{ matrix.step }}
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@7884fcad6b5d53d10323aee724dc68d8b9096a2e
       with:
         fetch-depth: 0
         token: ${{ secrets.GH_PAT }}
@@ -39,7 +39,7 @@ jobs:
     name: docker
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@7884fcad6b5d53d10323aee724dc68d8b9096a2e
     - name: docker
       env:
         DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
@@ -55,7 +55,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     name: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@7884fcad6b5d53d10323aee724dc68d8b9096a2e
         with:
           token: ${{ secrets.GH_PAT }}
       - name: Prepare for app notarization (macOS)
diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index 9c4afb9ae0..40c23dc266 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -10,8 +10,8 @@ jobs:
     if: "! startsWith(github.event.head_commit.message, '[CI Skip]') && (!github.event.pull_request || github.event.pull_request.head.repo.full_name == github.repository)"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: returntocorp/semgrep-action@v1
+      - uses: actions/checkout@7884fcad6b5d53d10323aee724dc68d8b9096a2e
+      - uses: returntocorp/semgrep-action@aeafd770072c4f48798b991e3449592bddc2c435
         with:
           auditOn: push
           publishToken: ${{ secrets.SEMGREP_APP_TOKEN }}
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index e686bbfb87..8ae958e720 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -7,7 +7,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v3
+      - uses: actions/stale@98ed4cb500039dbcccf4bd9bedada4d0187f2757
         with:
           repo-token: ${{ secrets.GH_PAT_BOT }}
           stale-issue-message: 'This issue has been open for 21 days with no activity and is not labelled as an enhancement. It will be closed in 7 days.'
diff --git a/.github/workflows/test-nightly.yml b/.github/workflows/test-nightly.yml
index 3c8628500e..62f8129297 100644
--- a/.github/workflows/test-nightly.yml
+++ b/.github/workflows/test-nightly.yml
@@ -12,7 +12,7 @@ jobs:
     name: ${{ matrix.step }}
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@7884fcad6b5d53d10323aee724dc68d8b9096a2e
     - name: ${{ matrix.step }}
       run: |
         yarn install --immutable | grep -v 'YN0013'