diff --git a/.github/workflows/deployment.yml b/.github/workflows/deployment.yml
index c0399026..8299e988 100644
--- a/.github/workflows/deployment.yml
+++ b/.github/workflows/deployment.yml
@@ -20,7 +20,7 @@ jobs:
       release_created: ${{ steps.release.outputs.release_created }}
       tag_name: ${{ steps.release.outputs.tag_name }}
     steps:
-      - uses: googleapis/release-please-action@v4
+      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5
         id: release
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -83,7 +83,7 @@ jobs:
         run: npm ci && npm --prefix packages/diracx-web-components run build-doc
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v4
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5
         with: 
           path: packages/diracx-web-components/storybook-static
 
@@ -97,7 +97,7 @@ jobs:
     steps:    
       - id: deploy
         name: Deploy to GitHub Pages
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5
         with:
           token: ${{ github.token }}
 
diff --git a/.github/workflows/diracx-web-test.yml b/.github/workflows/diracx-web-test.yml
index 587f5f3f..53165f33 100644
--- a/.github/workflows/diracx-web-test.yml
+++ b/.github/workflows/diracx-web-test.yml
@@ -57,7 +57,7 @@ jobs:
       run: echo "DIRACX_URL=https://$(ifconfig | grep 'inet ' | awk '{ print $2 }' | grep -v '^127' | head -n 1 | cut -d '/' -f 1).nip.io:8000" >> $GITHUB_ENV
 
     - name: Start Cypress
-      uses: cypress-io/github-action@v6
+      uses: cypress-io/github-action@dace029018fcdf86e0df89a31bc3cfa5b32570d8 # v7.3.0
       with:
         browser: chrome
         config: baseUrl=${{ env.DIRACX_URL }}
diff --git a/.github/workflows/gubbins-test.yml b/.github/workflows/gubbins-test.yml
index d247137f..2a0ab36f 100644
--- a/.github/workflows/gubbins-test.yml
+++ b/.github/workflows/gubbins-test.yml
@@ -166,7 +166,7 @@ jobs:
       # WARNING: In your CI/CD pipeline, you should remove the following steps  #
       # ------------------------------------------------------------------------#
       - name: Download gubbins-web
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: gubbins-web
           path: /tmp/gubbins-web
@@ -204,7 +204,7 @@ jobs:
         git clone https://github.com/DIRACGrid/diracx.git
 
     - name: Download gubbins images
-      uses: actions/download-artifact@v7
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
       with:
         name: gubbins-images
         path: /tmp/
@@ -217,7 +217,7 @@ jobs:
         rm -f /tmp/gubbins_client_image.tar
 
     - name: Download gubbins-web
-      uses: actions/download-artifact@v7
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
       with:
         name: gubbins-web
         path: /tmp/gubbins-web
@@ -279,7 +279,7 @@ jobs:
 
     # Run e2e tests with Cypress
     - name: Start Cypress
-      uses: cypress-io/github-action@v6
+      uses: cypress-io/github-action@dace029018fcdf86e0df89a31bc3cfa5b32570d8 # v7.3.0
       with:
         browser: chrome
         config: baseUrl=${{ env.DIRACX_URL }}