diff --git a/.github/workflows/benchmark.template.yaml b/.github/workflows/benchmark.template.yaml
index b4cd1c93..bad349d2 100644
--- a/.github/workflows/benchmark.template.yaml
+++ b/.github/workflows/benchmark.template.yaml
@@ -43,13 +43,13 @@ jobs:
           node-version-file: .node-version
 
       - name: setup rust
-        uses: actions-rs/toolchain@v1
+        uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1
         with:
           profile: minimal
           toolchain: stable
           override: true
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2
         
       - name: run subgraphs
         run: |
@@ -57,7 +57,7 @@ jobs:
         env:
           SUBGRAPH_DELAY_MS: ${{ inputs.subgraphDelay }}
 
-      - uses: grafana/setup-k6-action@v1
+      - uses: grafana/setup-k6-action@ffe7d7290dfa715e48c2ccc924d068444c94bde2 # v1
 
       - name: install
         run: ./install.sh
diff --git a/.github/workflows/website.yaml b/.github/workflows/website.yaml
index 369744c0..651e018a 100644
--- a/.github/workflows/website.yaml
+++ b/.github/workflows/website.yaml
@@ -19,7 +19,7 @@ jobs:
         working-directory: website
         run: npm run build
       - name: Deploy
-        uses: cloudflare/wrangler-action@v3.14.1
+        uses: cloudflare/wrangler-action@da0e0dfe58b7a431659754fdf3f186c529afbe65 # v3.14.1
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}