diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml
index 272dffeeb..2f3a641e8 100644
--- a/.github/workflows/ci-cd.yml
+++ b/.github/workflows/ci-cd.yml
@@ -519,7 +519,8 @@ jobs:
 
     steps:
     - name: Decide whether the needed jobs succeeded or failed
-      uses: re-actors/alls-green@release/v1
+      # yamllint disable-line rule:line-length
+      uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe  # release/v1
       with:
         jobs: ${{ toJSON(needs) }}
 
diff --git a/.github/workflows/reusable-tox.yml b/.github/workflows/reusable-tox.yml
index 81d66e61e..90a021ce3 100644
--- a/.github/workflows/reusable-tox.yml
+++ b/.github/workflows/reusable-tox.yml
@@ -173,7 +173,8 @@ jobs:
     - name: Retrieve the project source from an sdist inside the GHA artifact
       if: >-
         !contains(fromJSON('["pre-commit", "spellcheck-docs"]'), inputs.toxenv)
-      uses: re-actors/checkout-python-sdist@release/v2
+      # yamllint disable-line rule:line-length
+      uses: re-actors/checkout-python-sdist@187f55296b0f54d88259aaaf99af32ad3647d3bc  # release/v2
       with:
         source-tarball-name: ${{ inputs.source-tarball-name }}
         workflow-artifact-name: ${{ inputs.dists-artifact-name }}