diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f5bc1d7..ef05f8a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -80,7 +80,9 @@ jobs:
         if: steps.cache-cargo.outputs.cache-hit != 'true'
 
       - name: Install cargo-llvm-cov
-        uses: taiki-e/install-action@cargo-llvm-cov
+        uses: taiki-e/install-action@d6d752794628f1e1fffa3c4d3c8874e06f043d50 # v2.62.15
+        with:
+          tool: cargo-llvm-cov@0.6.19
 
       - name: Prepare test resources
         shell: bash
@@ -107,7 +109,7 @@ jobs:
         run: cargo llvm-cov --workspace --lcov --output-path lcov.info
 
       - name: Upload code coverage to Coveralls
-        uses: coverallsapp/github-action@v2
+        uses: coverallsapp/github-action@648a8eb78e6d50909eff900e4ec85cab4524a45b # v2.3.6
         continue-on-error: true
 
       # Need to rebuild the FFI wrapper so that its binary is given a filename
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8945704..5c33bde 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,7 +16,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: rust-lang/crates-io-auth-action@v1
+      - uses: rust-lang/crates-io-auth-action@e919bc7605cde86df457cf5b93c5e103838bd879 # v1.0.1
         id: auth
 
       - run: cargo publish