diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1110dc5e..28918a42 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-22.04
     timeout-minutes: 2
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
     - name: make & test tcc (x86_64-linux)
       run: ./configure && make && make test -k
 
@@ -17,7 +17,7 @@ jobs:
     runs-on: macos-13
     timeout-minutes: 2
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
     - name: make & test tcc (x86_64-osx)
       run: ./configure && make && make test -k
 
@@ -25,7 +25,7 @@ jobs:
     runs-on: macos-14
     timeout-minutes: 2
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
     - name: make & test tcc (aarch64-osx)
       run: ./configure && make && make test -k
 
@@ -33,7 +33,7 @@ jobs:
     runs-on: windows-2025
     timeout-minutes: 6
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
     - name: make & test tcc (x86_64-win32)
       shell: cmd
       run: |
@@ -44,7 +44,7 @@ jobs:
         C:\msys64\usr\bin\bash -l -c "pacman -S --noconfirm mingw-w64-x86_64-gcc"
         echo ::endgroup::
         C:\msys64\usr\bin\bash -l -c "./configure && make && make test -k"
-    - uses: ilammy/msvc-dev-cmd@v1
+    - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
       with:
         arch: amd64
     - name: build with MSVC (x86_64-win32)
@@ -61,7 +61,7 @@ jobs:
     runs-on: windows-2025
     timeout-minutes: 6
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
     - name: make & test tcc (i386-win32)
       shell: cmd
       run: |
@@ -72,7 +72,7 @@ jobs:
         C:\msys64\usr\bin\bash -l -c "pacman -S --noconfirm mingw-w64-i686-gcc"
         echo ::endgroup::
         C:\msys64\usr\bin\bash -l -c "./configure && make && make test -k"
-    - uses: ilammy/msvc-dev-cmd@v1
+    - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
       with:
         arch: x86
     - name: build with MSVC (i386-win32)
@@ -89,8 +89,8 @@ jobs:
     runs-on: ubuntu-22.04
     timeout-minutes: 8
     steps:
-    - uses: actions/checkout@v4
-    - uses: uraimo/run-on-arch-action@v3
+    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+    - uses: uraimo/run-on-arch-action@d94c13912ea685de38fccc1109385b83fd79427d # v3.0.1
       name: make & test tcc (armv7-linux)
       with:
         arch: armv7
@@ -107,8 +107,8 @@ jobs:
     runs-on: ubuntu-22.04
     timeout-minutes: 8
     steps:
-    - uses: actions/checkout@v4
-    - uses: uraimo/run-on-arch-action@v3
+    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+    - uses: uraimo/run-on-arch-action@d94c13912ea685de38fccc1109385b83fd79427d # v3.0.1
       name: make & test tcc (aarch64-linux)
       with:
         arch: aarch64
@@ -125,8 +125,8 @@ jobs:
     runs-on: ubuntu-22.04
     timeout-minutes: 8
     steps:
-    - uses: actions/checkout@v4
-    - uses: uraimo/run-on-arch-action@v3
+    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+    - uses: uraimo/run-on-arch-action@d94c13912ea685de38fccc1109385b83fd79427d # v3.0.1
       name: make & test tcc (riscv64-linux)
       with:
         arch: riscv64