diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index bfce45f..15a1d4f 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -23,10 +23,10 @@ jobs:
           fetch-depth: 2
       - name: Set up Python
         id: setup-python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4
       - name: Cache Poetry
         id: cache-poetry
-        uses: actions/cache@v3
+        uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3
         with:
           path: ${{ env.POETRY_HOME }}
           key: poetry-${{ runner.os }}-${{ steps.setup-python.outputs.python-version }}-${{ env.POETRY_VERSION }}
@@ -37,7 +37,7 @@ jobs:
         run: echo ${{ env.POETRY_HOME }}/bin >> "$GITHUB_PATH"
       - name: Cache venv
         id: cache-venv
-        uses: actions/cache@v3
+        uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3
         with:
           path: .venv
           key: venv-${{ runner.os }}-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('poetry.lock') }}
@@ -49,7 +49,7 @@ jobs:
         run: poetry install --no-interaction --only-root -v
       - name: Cache pre-commit hooks
         id: cache-pre-commit
-        uses: actions/cache@v3
+        uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3
         with:
           path: ~/.cache/pre-commit
           key: pre-commit-${{ runner.os }}-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('.pre-commit-config.yaml') }}
@@ -78,12 +78,12 @@ jobs:
           fetch-depth: 0
       - name: Set up Python
         id: setup-python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4
         with:
           python-version: ${{ matrix.python-version }}
       - name: Cache Poetry
         id: cache-poetry
-        uses: actions/cache@v3
+        uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3
         with:
           path: ${{ env.POETRY_HOME }}
           key: poetry-${{ runner.os }}-${{ steps.setup-python.outputs.python-version }}-${{ env.POETRY_VERSION }}
@@ -94,7 +94,7 @@ jobs:
         run: echo ${{ env.POETRY_HOME }}/bin >> "$GITHUB_PATH"
       - name: Cache venv
         id: cache-venv
-        uses: actions/cache@v3
+        uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3
         with:
           path: .venv
           key: venv-${{ runner.os }}-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('poetry.lock') }}
@@ -107,7 +107,7 @@ jobs:
       - name: Run pytest
         run: poetry run pytest --color=yes --cov-config=pyproject.toml --with-functional
       - name: Upload coverage report
-        uses: codecov/codecov-action@v3.1.4
+        uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d # v3.1.4
       - name: Run SonarCloud scanner
         uses: SonarSource/sonarcloud-github-action@4b4d7634dab97dcee0b75763a54a6dc92a9e6bc1 # v2.0.0
         if: matrix.os == 'ubuntu-latest'
@@ -130,10 +130,10 @@ jobs:
           fetch-depth: 0
       - name: Set up Python
         id: setup-python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4
       - name: Cache Poetry
         id: cache-poetry
-        uses: actions/cache@v3
+        uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3
         with:
           path: ${{ env.POETRY_HOME }}
           key: poetry-${{ runner.os }}-${{ steps.setup-python.outputs.python-version }}-${{ env.POETRY_VERSION }}
@@ -144,7 +144,7 @@ jobs:
         run: echo ${{ env.POETRY_HOME }}/bin >> "$GITHUB_PATH"
       - name: Cache venv
         id: cache-venv
-        uses: actions/cache@v3
+        uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3
         with:
           path: .venv
           key: venv-${{ runner.os }}-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('poetry.lock') }}
@@ -171,4 +171,4 @@ jobs:
         run: poetry run semantic-release publish
       - name: Publish package distributions to PyPI
         if: steps.bump-version.outputs.released == 'true'
-        uses: pypa/gh-action-pypi-publish@v1.8.10
+        uses: pypa/gh-action-pypi-publish@b7f401de30cb6434a1e19f805ff006643653240e # v1.8.10