diff --git a/.github/actions/cache/action.yml b/.github/actions/cache/action.yml
index b323c1fe52..03c145a73b 100644
--- a/.github/actions/cache/action.yml
+++ b/.github/actions/cache/action.yml
@@ -29,7 +29,7 @@ runs:
     # if it makes the expression below simpler. hashFiles() has a timer that
     # will fail the job if it times out, which can happen if there are too many
     # files to search through.
-    - uses: actions/cache@v5
+    - uses: actions/cache@v5.0.4
       with:
         path: .deps
         key: ${{ env.CACHE_KEY }}-${{ steps.image.outputs.version }}-${{ hashFiles('cmake**',
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index edd0d1ba63..b7a028002a 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -31,11 +31,11 @@ jobs:
     - uses: ./.github/actions/setup
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
+      uses: github/codeql-action/init@v4.35.1
       with:
         languages: cpp
 
     - run: make
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4
+      uses: github/codeql-action/analyze@v4.35.1