diff --git a/.github/workflows/pytest-optional.yml b/.github/workflows/pytest-optional.yml
index e2968438e12..f43a636e1be 100644
--- a/.github/workflows/pytest-optional.yml
+++ b/.github/workflows/pytest-optional.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-22.04
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
     - id: check
       uses: ./.github/actions/activate-tests
 
diff --git a/.github/workflows/pytest-template.yml b/.github/workflows/pytest-template.yml
index 56f1352c476..accea5fe9b3 100644
--- a/.github/workflows/pytest-template.yml
+++ b/.github/workflows/pytest-template.yml
@@ -44,7 +44,7 @@ jobs:
     runs-on: ${{ inputs.os-version }}
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
     - uses: ./.github/actions/setup
       with:
         tf-version: ${{ inputs.tf-version }}
diff --git a/.github/workflows/pytest.yml b/.github/workflows/pytest.yml
index 40263432b26..72e7cd922e7 100644
--- a/.github/workflows/pytest.yml
+++ b/.github/workflows/pytest.yml
@@ -35,7 +35,7 @@ jobs:
     runs-on: ubuntu-22.04
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
     - id: check
       uses: ./.github/actions/activate-tests
 
@@ -63,7 +63,7 @@ jobs:
     timeout-minutes: 30
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
     - uses: ./.github/actions/setup
       with:
         tf-version: tensorflow
@@ -85,7 +85,7 @@ jobs:
     timeout-minutes: 30
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
     - uses: ./.github/actions/setup
       with:
         tf-version: tensorflow
@@ -104,7 +104,7 @@ jobs:
     timeout-minutes: 30
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
     - uses: ./.github/actions/setup
       with:
         tf-version: tensorflow
diff --git a/.github/workflows/release-nightly.yml b/.github/workflows/release-nightly.yml
index 2b540cd49ea..c1b173734d0 100644
--- a/.github/workflows/release-nightly.yml
+++ b/.github/workflows/release-nightly.yml
@@ -24,7 +24,7 @@ jobs:
       run: echo "TFDS_NIGHTLY_TIMESTAMP=$(date +'%Y%m%d%H%M')" >> $GITHUB_ENV
 
     - name: Publish the package
-      uses: etils-actions/pypi-auto-publish@v1
+      uses: etils-actions/pypi-auto-publish@e3c4b4afc3a5b12a44734da938741995538e8223 # v1
       with:
         pypi-token: ${{ secrets.NIGHTLY_PYPI_PASSWORD }}
         parse-changelog: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index edc771a040e..f67ee6ed0df 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,7 +24,7 @@ jobs:
       contents: write
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
       with:
         ref: ${{ github.event.inputs.git-ref }}
 
@@ -35,7 +35,7 @@ jobs:
 
     # Publish the package (if local `__version__` > pip version)
     - name: Publish the package
-      uses: etils-actions/pypi-auto-publish@v1
+      uses: etils-actions/pypi-auto-publish@e3c4b4afc3a5b12a44734da938741995538e8223 # v1
       with:
         pypi-token: ${{ secrets.PYPI_PASSWORD }}
         gh-token: ${{ secrets.GITHUB_TOKEN }}