diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml
index 0312efef..d32a5537 100644
--- a/.github/actions/setup/action.yml
+++ b/.github/actions/setup/action.yml
@@ -16,7 +16,7 @@ runs:
   using: composite
   steps:
     - name: Install Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5
       with:
         python-version: ${{ inputs.version }}
 
diff --git a/.github/workflows/build-and-run-example.yml b/.github/workflows/build-and-run-example.yml
index faaae48b..9ed2801e 100644
--- a/.github/workflows/build-and-run-example.yml
+++ b/.github/workflows/build-and-run-example.yml
@@ -19,7 +19,7 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           fetch-depth: 1
       - uses: ./.github/actions/setup
diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index f4d7533f..70e79c5d 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -16,7 +16,7 @@ jobs:
       MODAL_ENVIRONMENT: examples
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           fetch-depth: 1
       - uses: ./.github/actions/setup
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 2bad2a68..389433fc 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-24.04
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           fetch-depth: 1
       - uses: ./.github/actions/setup
@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-24.04
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           fetch-depth: 1
       - uses: ./.github/actions/setup
@@ -41,7 +41,7 @@ jobs:
     runs-on: ubuntu-24.04
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           fetch-depth: 1
       - uses: ./.github/actions/setup
diff --git a/.github/workflows/preview-docs.yml b/.github/workflows/preview-docs.yml
index 032a6f17..f4761c20 100644
--- a/.github/workflows/preview-docs.yml
+++ b/.github/workflows/preview-docs.yml
@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: Checkout modal repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           repository: modal-labs/modal
           token: ${{ secrets.GH_PAT }}
@@ -24,7 +24,7 @@ jobs:
           persist-credentials: false
 
       - name: Install Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5
         with:
           python-version: "3.11"
 
@@ -39,7 +39,7 @@ jobs:
           uv pip install --system -r modal/requirements.dev.txt
 
       - name: Checkout client repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           repository: modal-labs/modal-client
           token: ${{ secrets.GH_PAT }}
@@ -52,7 +52,7 @@ jobs:
           uv pip install --system -e client
 
       - name: Install node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
         with:
           node-version-file: modal/.nvmrc
 
@@ -68,7 +68,7 @@ jobs:
           inv protoc
 
       - name: Checkout examples repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           fetch-depth: 1
           path: modal/examples
@@ -85,7 +85,7 @@ jobs:
 
       - name: Post a comment with the preview URL
         if: github.event_name == 'pull_request'
-        uses: actions/github-script@v6
+        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6
         with:
           github-token: ${{ secrets.GH_PAT }}
           script: |
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index bcebc85a..fe94bb66 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -14,7 +14,7 @@ jobs:
     name: Close stale PRs
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v9
+      - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9
         with:
           stale-pr-message: |
             This PR is stale because it has been open 30 days with no activity.
@@ -31,7 +31,7 @@ jobs:
     name: Remove stale branches
     runs-on: ubuntu-latest
     steps:
-      - uses: fpicalausa/remove-stale-branches@v1.6.0
+      - uses: fpicalausa/remove-stale-branches@bfaf2b7f95cfd85485960c9d2d98a0702c84a74c # v1.6.0
         with:
           operations-per-run: 500
           days-before-branch-stale: 30
diff --git a/.github/workflows/typecheck.yml b/.github/workflows/typecheck.yml
index 31d0aa4c..bb128b03 100644
--- a/.github/workflows/typecheck.yml
+++ b/.github/workflows/typecheck.yml
@@ -12,9 +12,9 @@ jobs:
     runs-on: ubuntu-24.04
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4
         with:
           python-version: "3.11"