diff --git a/.github/workflows/lock.yml b/.github/workflows/lock.yml
index ab9529b65..902783e08 100644
--- a/.github/workflows/lock.yml
+++ b/.github/workflows/lock.yml
@@ -19,7 +19,7 @@ jobs:
     if: github.repository == 'tmux/tmux'
     timeout-minutes: 10
     steps:
-      - uses: dessant/lock-threads@v6
+      - uses: dessant/lock-threads@89ae32b08ed1a541efecbab17912962a5e38981c # v6
         with:
           github-token: ${{ github.token }}
           issue-inactive-days: '30'
diff --git a/.github/workflows/regress.yml b/.github/workflows/regress.yml
index 376fc7bde..b1e19e9e0 100644
--- a/.github/workflows/regress.yml
+++ b/.github/workflows/regress.yml
@@ -38,7 +38,7 @@ jobs:
 
     steps:
       - name: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           persist-credentials: false
 
@@ -83,7 +83,7 @@ jobs:
 
       - name: logs
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: regress-logs-${{ matrix.name }}
           path: regress/logs/*.log