diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e9e23e40..8af33787 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -82,7 +82,7 @@ jobs:
           github.event_name == 'schedule' ||
           (github.event_name == 'pull_request' &&
            github.event.pull_request.head.repo.full_name == github.repository)
-        uses: cloudflare/wrangler-action@v3
+        uses: cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
@@ -101,7 +101,7 @@ jobs:
         if: |
           github.event_name == 'pull_request' &&
           steps.deploy.outputs.deployment-url
-        uses: marocchino/sticky-pull-request-comment@v2
+        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2
         with:
           header: cloudflare-pages-preview
           message: |
diff --git a/.github/workflows/plain-sync.yml b/.github/workflows/plain-sync.yml
index add21f18..88bcdb27 100644
--- a/.github/workflows/plain-sync.yml
+++ b/.github/workflows/plain-sync.yml
@@ -70,7 +70,7 @@ jobs:
 
       - name: Comment on PR
         if: steps.diff.outputs.changed == 'true'
-        uses: marocchino/sticky-pull-request-comment@v2
+        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2
         with:
           header: plain-sync
           message: |