diff --git a/.github/actions/artifact/download/action.yml b/.github/actions/artifact/download/action.yml
index baed4188aa37..0f5ca58fd34c 100644
--- a/.github/actions/artifact/download/action.yml
+++ b/.github/actions/artifact/download/action.yml
@@ -18,7 +18,7 @@ runs:
   using: composite
   steps:
     - name: Download artifact from github
-      uses: actions/download-artifact@v4.1.7
+      uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
       if: ${{ !startsWith(runner.name, 'rspack') || inputs.force-use-github-only == 'true' }}
       with:
         name: ${{ inputs.name }}
diff --git a/.github/actions/artifact/upload/action.yml b/.github/actions/artifact/upload/action.yml
index ff8d04659cf9..6e94ef294cbb 100644
--- a/.github/actions/artifact/upload/action.yml
+++ b/.github/actions/artifact/upload/action.yml
@@ -28,7 +28,7 @@ runs:
         overwrite: true
 
     - name: Upload artifact to github
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: ${{ inputs.name }}
         path: ${{ inputs.path }}
diff --git a/.github/workflows/bench-rust.yml b/.github/workflows/bench-rust.yml
index c8238dc0dbfa..8967f89d4453 100644
--- a/.github/workflows/bench-rust.yml
+++ b/.github/workflows/bench-rust.yml
@@ -90,7 +90,7 @@ jobs:
 
       - name: Upload Valgrind temporary files
         if: ${{ always() }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: codspeed-valgrind-tmp-${{ inputs.target }}
           path: ${{ runner.temp }}/codspeed-valgrind-tmp
diff --git a/.github/workflows/preview-commit.yml b/.github/workflows/preview-commit.yml
index 475abb653cd4..efd0d496dfa1 100644
--- a/.github/workflows/preview-commit.yml
+++ b/.github/workflows/preview-commit.yml
@@ -79,7 +79,7 @@ jobs:
         run: pnpm i
 
       - name: Download artifacts
-        uses: actions/download-artifact@v4.1.7
+        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
         with:
           path: artifacts
 
diff --git a/.github/workflows/release-canary.yml b/.github/workflows/release-canary.yml
index b9f39cbbe45d..ba9eb055ef56 100644
--- a/.github/workflows/release-canary.yml
+++ b/.github/workflows/release-canary.yml
@@ -98,7 +98,7 @@ jobs:
         run: pnpm i
 
       - name: Download artifacts
-        uses: actions/download-artifact@v4.1.7
+        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
         with:
           path: artifacts
           pattern: bindings-*
diff --git a/.github/workflows/release-debug.yml b/.github/workflows/release-debug.yml
index 28b3cc392f66..679446b9f236 100644
--- a/.github/workflows/release-debug.yml
+++ b/.github/workflows/release-debug.yml
@@ -47,7 +47,7 @@ jobs:
         run: pnpm i
 
       - name: Download artifacts
-        uses: actions/download-artifact@v4.1.7
+        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
         with:
           path: artifacts
           pattern: bindings-*
diff --git a/.github/workflows/reusable-build-test.yml b/.github/workflows/reusable-build-test.yml
index 869ba965e124..8a1910d3c21e 100644
--- a/.github/workflows/reusable-build-test.yml
+++ b/.github/workflows/reusable-build-test.yml
@@ -189,7 +189,7 @@ jobs:
 
       - name: Upload Test Reporter
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: rstest-event-reports-${{ inputs.target }}-node${{ matrix.node }}
           path: '*-report.txt'
diff --git a/.github/workflows/reusable-release-npm.yml b/.github/workflows/reusable-release-npm.yml
index 63147e14232b..cf59601b137a 100644
--- a/.github/workflows/reusable-release-npm.yml
+++ b/.github/workflows/reusable-release-npm.yml
@@ -99,7 +99,7 @@ jobs:
         run: pnpm i
 
       - name: Download artifacts
-        uses: actions/download-artifact@v4.1.7
+        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
         with:
           path: artifacts
           pattern: bindings-*