diff --git a/.github/workflows/create_pull_request.yml b/.github/workflows/create_pull_request.yml
index 043d0f2..7eaf548 100644
--- a/.github/workflows/create_pull_request.yml
+++ b/.github/workflows/create_pull_request.yml
@@ -23,7 +23,7 @@ jobs:
       issue: ${{ inputs.issue }}
     steps:
       - name: checkout
-        uses: actions/checkout@v4.1.0
+        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
         with:
           ref: ${{ github.event.repository.default_branch }}
       - name: open pr
diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
index e62373f..c39ea7b 100644
--- a/.github/workflows/pull_request.yml
+++ b/.github/workflows/pull_request.yml
@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Assign author to PR
-        uses: technote-space/assign-author@v1
+        uses: technote-space/assign-author@9558557c5c4816f38bd06176fbc324ba14bb3160 # v1
   validate:
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/validate_json.yml b/.github/workflows/validate_json.yml
index f556348..5bfd72a 100644
--- a/.github/workflows/validate_json.yml
+++ b/.github/workflows/validate_json.yml
@@ -6,7 +6,7 @@ jobs:
   verify-json-validation:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
       - name: Validate config
         uses: docker://orrosenblatt/validate-json-action:latest
         env: