diff --git a/.github/workflows/back-merge-handler.yml b/.github/workflows/back-merge-handler.yml
index 0346f03..9c11220 100644
--- a/.github/workflows/back-merge-handler.yml
+++ b/.github/workflows/back-merge-handler.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.ref_name == 'master'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
 
@@ -49,7 +49,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.ref_name == 'stable'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/run-smoke-test.yml b/.github/workflows/run-smoke-test.yml
index f074747..ea8f181 100755
--- a/.github/workflows/run-smoke-test.yml
+++ b/.github/workflows/run-smoke-test.yml
@@ -11,8 +11,8 @@ jobs:
   run_smoke_test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-java@v1
+      - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2
+      - uses: actions/setup-java@0f62d2ad8407a414cddd4790bed06fd9ebda0f56 # v1
         with:
           java-version: 11
           java-package: jdk