diff --git a/.github/workflows/deploy-appstore-meta.yml b/.github/workflows/deploy-appstore-meta.yml
index 3a87522..b77f113 100644
--- a/.github/workflows/deploy-appstore-meta.yml
+++ b/.github/workflows/deploy-appstore-meta.yml
@@ -35,12 +35,12 @@ jobs:
             echo "enabled=false" >> "$GITHUB_OUTPUT"
           fi
 
-      - uses: google-github-actions/auth@v2
+      - uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed # v2
         if: steps.gate.outputs.enabled == 'true'
         with:
           credentials_json: ${{ secrets.APPSTORE_META_GCP_SA_KEY }}
 
-      - uses: google-github-actions/setup-gcloud@v2
+      - uses: google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f # v2
         if: steps.gate.outputs.enabled == 'true'
 
       - name: Rebuild and restart metadata API
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 853852f..abb1c8a 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -47,12 +47,12 @@ jobs:
             echo "enabled=false" >> "$GITHUB_OUTPUT"
           fi
 
-      - uses: google-github-actions/auth@v2
+      - uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed # v2
         if: steps.gate.outputs.enabled == 'true'
         with:
           credentials_json: ${{ secrets.GCP_SA_KEY }}
 
-      - uses: google-github-actions/setup-gcloud@v2
+      - uses: google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f # v2
         if: steps.gate.outputs.enabled == 'true'
 
       - name: Pull, rebuild, restart on the VM