diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3b49c9e..aeb4fa7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,8 +25,8 @@ jobs:
       version: ${{ steps.semver.outputs.SCRATCH_VERSION }}
       hash: ${{ steps.semver.outputs.SCRATCH_HASH }}
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+      - uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v3
         with:
           cache: 'npm'
           node-version-file: '.nvmrc'
@@ -54,7 +54,7 @@ jobs:
           EOF
       - name: Create artifact for semantic-release 'remote'
         run: tar czvf semantic-release-remote.tgz semantic-release-remote
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3
         with:
           name: semantic-release-remote
           path: semantic-release-remote.tgz
@@ -82,8 +82,8 @@ jobs:
       #  uses: lhotari/action-upterm@v1
       #  with:
       #    limit-access-to-users: cwillisf
-      - uses: actions/checkout@v3
-      - uses: actions/download-artifact@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+      - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3
         with:
           name: semantic-release-remote
           path: .
@@ -102,7 +102,7 @@ jobs:
 
       - name: "macOS: Setup keys for Fastlane"
         if: runner.os == 'macOS' && env.FASTLANE_ACCESS_KEY != ''
-        uses: webfactory/ssh-agent@v0.8.0
+        uses: webfactory/ssh-agent@d4b9b8ff72958532804b70bbe600ad43b36d5f2e # v0.8.0
         with:
             ssh-private-key: ${{ secrets.FASTLANE_ACCESS_KEY }}
       - name: "macOS: Fastlane Match"
@@ -123,15 +123,15 @@ jobs:
 
       - name: "Windows: Add msbuild to PATH"
         if: runner.os == 'Windows'
-        uses: microsoft/setup-msbuild@v1.1
+        uses: microsoft/setup-msbuild@34cfbaee7f672c76950673338facd8a73f637506 # v1.1
 
       ### Shared setup
 
       - name: Setup dotnet
-        uses: actions/setup-dotnet@v3
+        uses: actions/setup-dotnet@3447fd6a9f9e57506b15f895c5b76d3b197dc7c2 # v3
         with:
           dotnet-version: '6.0.x'
-      - uses: actions/cache@v3
+      - uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3
         with:
           path: ~/.nuget/packages
           # Look to see if there is a cache hit for the corresponding requirements file
@@ -185,7 +185,7 @@ jobs:
 
       ### Shared epilogue
 
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3
         with:
           name: "Scratch ${{ needs.semver.outputs.version }} (${{ needs.semver.outputs.hash }})"
           path: Artifacts/
@@ -195,7 +195,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     steps:
-      - uses: geekyeggo/delete-artifact@v2
+      - uses: geekyeggo/delete-artifact@54ab544f12cdb7b71613a16a2b5a37a9ade990af # v2
         with:
           name: semantic-release-remote
           failOnError: false