diff --git a/.github/actions/setup-playwright/action.yaml b/.github/actions/setup-playwright/action.yaml
index 3ecac2c..465862a 100644
--- a/.github/actions/setup-playwright/action.yaml
+++ b/.github/actions/setup-playwright/action.yaml
@@ -21,7 +21,7 @@ runs:
   using: composite
   steps:
     - name: Get Playwright version
-      uses: actions/github-script@v7
+      uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
       id: version
       with:
         script: |
@@ -45,7 +45,7 @@ runs:
 
     - name: Cache Playwright
       id: cache
-      uses: actions/cache@v4
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       with:
         path: ~/.cache/ms-playwright
         key: playwright-${{ env.PLAYWRIGHT_VERSION }}
diff --git a/.github/workflows/ci-cd.yaml b/.github/workflows/ci-cd.yaml
index ba9bdbe..9038fb5 100644
--- a/.github/workflows/ci-cd.yaml
+++ b/.github/workflows/ci-cd.yaml
@@ -33,7 +33,7 @@ jobs:
           install-playwright: true
           playwright-browsers: chromium
       - name: Run tests
-        uses: coactions/setup-xvfb@v1
+        uses: coactions/setup-xvfb@b6b4fcfb9f5a895edadc3bc76318fae0ac17c8b3 # v1
         with:
           run: npm run test:ci
 
@@ -66,7 +66,7 @@ jobs:
           zip -r extension.zip ${{ github.event.repository.name }}
       - name: Upload release assets
         if: ${{ steps.release.outputs.releases_created == 'true' }}
-        uses: actions/upload-release-asset@v1
+        uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1
         with:
           upload_url: ${{ steps.release.outputs.upload_url }}
           asset_path: extension.zip