diff --git a/.github/workflows/build-packages.yml b/.github/workflows/build-packages.yml
index 8cdec65..a826fdd 100644
--- a/.github/workflows/build-packages.yml
+++ b/.github/workflows/build-packages.yml
@@ -18,8 +18,8 @@ jobs:
       GOARCH: amd64
       CGO_ENABLED: 1
     steps:
-        - uses: actions/checkout@v4.2.2
-        - uses: actions/setup-go@v5
+        - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
           with:
             go-version: '1.22.12'
         - name: Build Macos executable
@@ -49,8 +49,8 @@ jobs:
       GOARCH: amd64
       CGO_ENABLED: 1
     steps:
-        - uses: actions/checkout@v4.2.2
-        - uses: actions/setup-go@v5
+        - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
           with:
             go-version: '1.22.12'
         - name: go dependencies
@@ -77,7 +77,7 @@ jobs:
     name: Linux build
     runs-on: ubuntu-latest
     steps:
-        - uses: actions/checkout@v4.2.2
+        - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         - name: Build builder Docker image
           uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75
           with:
@@ -118,7 +118,7 @@ jobs:
           password: ${{ secrets.DOCKER_PASSWORD }}
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v4 # v4
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0 # v4
         with:
           images: |
             dnanexus/dxda
diff --git a/.github/workflows/build-tests.yml b/.github/workflows/build-tests.yml
index 0bd15ab..37c8795 100644
--- a/.github/workflows/build-tests.yml
+++ b/.github/workflows/build-tests.yml
@@ -14,8 +14,8 @@ jobs:
       GOARCH: amd64
       CGO_ENABLED: 1
     steps:
-        - uses: actions/checkout@v4.2.2
-        - uses: actions/setup-go@v5
+        - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
           with:
             go-version: '1.22.12'
         - name: Build Macos executable
@@ -32,8 +32,8 @@ jobs:
       GOARCH: amd64
       CGO_ENABLED: 1
     steps:
-        - uses: actions/checkout@v4.2.2
-        - uses: actions/setup-go@v5
+        - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
           with:
             go-version: '1.22.12'
         - name: Build Windows executable
@@ -44,7 +44,7 @@ jobs:
     name: Linux build and test
     runs-on: ubuntu-latest
     steps:
-        - uses: actions/checkout@v4.2.2
+        - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         - name: Build builder Docker image
           uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75
           with: