diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml
index 0e0abaf95ee..4418942781d 100644
--- a/.github/workflows/cifuzz.yml
+++ b/.github/workflows/cifuzz.yml
@@ -17,27 +17,27 @@ jobs:
     steps:
     - name: Build Fuzzers
       id: build
-      uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
+      uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@038609bc07cdf90a4b737705d26acad907725df9
       with:
         oss-fuzz-project-name: 'pillow'
         language: python
         dry-run: false
     - name: Run Fuzzers
       id: run
-      uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
+      uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@038609bc07cdf90a4b737705d26acad907725df9
       with:
         oss-fuzz-project-name: 'pillow'
         fuzz-seconds: 600
         language: python
         dry-run: false
     - name: Upload New Crash
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8
       if: failure() && steps.build.outcome == 'success'
       with:
         name: artifacts
         path: ./out/artifacts
     - name: Upload Legacy Crash
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8
       if: steps.run.outcome == 'success'
       with:
         name: crash
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 527f26d35d4..fee13cfb116 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -13,10 +13,10 @@ jobs:
     name: Lint
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
 
     - name: pre-commit cache
-      uses: actions/cache@v2
+      uses: actions/cache@937d24475381cd9c75ae6db12cb4e79714b926ed
       with:
         path: ~/.cache/pre-commit
         key: lint-pre-commit-${{ hashFiles('**/.pre-commit-config.yaml') }}
@@ -24,7 +24,7 @@ jobs:
           lint-pre-commit-
 
     - name: Set up Python
-      uses: actions/setup-python@v3
+      uses: actions/setup-python@98f2ad02fd48d057ee3b4d4f66525b231c3e52b6
       with:
         python-version: "3.10"
         cache: pip
diff --git a/.github/workflows/release-drafter.yml b/.github/workflows/release-drafter.yml
index 7ee76c4ac8c..a46c5c0d25d 100644
--- a/.github/workflows/release-drafter.yml
+++ b/.github/workflows/release-drafter.yml
@@ -19,6 +19,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # Drafts your next release notes as pull requests are merged into "main"
-      - uses: release-drafter/release-drafter@v5
+      - uses: release-drafter/release-drafter@06a49bf28488e030d35ca2ac6dbf7f408a481779
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index cc5e0d488ab..249942c83f3 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -16,7 +16,7 @@ jobs:
 
     steps:
     - name: "Check issues"
-      uses: actions/stale@v5
+      uses: actions/stale@9c1b1c6e115ca2af09755448e0dbba24e5061cc8
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         only-labels: "Awaiting OP Action"
diff --git a/.github/workflows/test-cygwin.yml b/.github/workflows/test-cygwin.yml
index 417b1f21276..cd1f45b4895 100644
--- a/.github/workflows/test-cygwin.yml
+++ b/.github/workflows/test-cygwin.yml
@@ -20,10 +20,10 @@ jobs:
           git config --global core.autocrlf input
 
       - name: Checkout Pillow
-        uses: actions/checkout@v3
+        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
 
       - name: Install Cygwin
-        uses: cygwin/cygwin-install-action@v2
+        uses: cygwin/cygwin-install-action@49f298a7ebb00d4b3ddf58000c3e78eff5fbd6b9
         with:
           platform: x86_64
           packages: >
@@ -41,12 +41,12 @@ jobs:
             qt5-devel-tools subversion xorg-server-extra zlib-devel
 
       - name: Add Lapack to PATH
-        uses: egor-tensin/cleanup-path@v1
+        uses: egor-tensin/cleanup-path@39324b3c13fae7f8237b32d446b474ba9f135531
         with:
           dirs: 'C:\cygwin\bin;C:\cygwin\lib\lapack'
 
       - name: pip cache
-        uses: actions/cache@v3
+        uses: actions/cache@fd5de65bc895cf536527842281bea11763fefd77
         with:
           path: 'C:\cygwin\home\runneradmin\.cache\pip'
           key: ${{ runner.os }}-cygwin-pip3.${{ matrix.python-minor-version }}-${{ hashFiles('.ci/install.sh') }}
@@ -81,7 +81,7 @@ jobs:
           dash.exe -c "mkdir -p Tests/errors"
 
       - name: Upload errors
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8
         if: failure()
         with:
           name: errors
@@ -92,7 +92,7 @@ jobs:
           bash.exe .ci/after_success.sh
 
       - name: Upload coverage
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@81cd2dc8148241f03f5839d295e000b8f761e378
         with:
           file: ./coverage.xml
           flags: GHA_Cygwin
diff --git a/.github/workflows/test-docker.yml b/.github/workflows/test-docker.yml
index 5376791e970..bb04d85ab59 100644
--- a/.github/workflows/test-docker.yml
+++ b/.github/workflows/test-docker.yml
@@ -45,7 +45,7 @@ jobs:
     name: ${{ matrix.docker }}
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
 
     - name: Build system information
       run: python3 .github/workflows/system-info.py
@@ -79,7 +79,7 @@ jobs:
         MATRIX_DOCKER: ${{ matrix.docker }}
 
     - name: Upload coverage
-      uses: codecov/codecov-action@v3
+      uses: codecov/codecov-action@29386c70ef20e286228c72b668a06fd0e8399192
       with:
         flags: GHA_Docker
         name: ${{ matrix.docker }}
diff --git a/.github/workflows/test-mingw.yml b/.github/workflows/test-mingw.yml
index 7ddb71e1f68..b0f13a1a316 100644
--- a/.github/workflows/test-mingw.yml
+++ b/.github/workflows/test-mingw.yml
@@ -32,7 +32,7 @@ jobs:
 
     steps:
       - name: Checkout Pillow
-        uses: actions/checkout@v3
+        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
 
       - name: Set up shell
         run: echo "C:\msys64\usr\bin\" >> $env:GITHUB_PATH
diff --git a/.github/workflows/test-valgrind.yml b/.github/workflows/test-valgrind.yml
index dda1b357785..3dff6b13a6f 100644
--- a/.github/workflows/test-valgrind.yml
+++ b/.github/workflows/test-valgrind.yml
@@ -31,7 +31,7 @@ jobs:
     name: ${{ matrix.docker }}
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
 
     - name: Build system information
       run: python3 .github/workflows/system-info.py
diff --git a/.github/workflows/test-windows.yml b/.github/workflows/test-windows.yml
index ca608e127c2..d9dce1fb3cf 100644
--- a/.github/workflows/test-windows.yml
+++ b/.github/workflows/test-windows.yml
@@ -26,17 +26,17 @@ jobs:
 
     steps:
     - name: Checkout Pillow
-      uses: actions/checkout@v3
+      uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
 
     - name: Checkout cached dependencies
-      uses: actions/checkout@v3
+      uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
       with:
         repository: python-pillow/pillow-depends
         path: winbuild\depends
 
     # sets env: pythonLocation
     - name: Set up Python
-      uses: actions/setup-python@v3
+      uses: actions/setup-python@98f2ad02fd48d057ee3b4d4f66525b231c3e52b6
       with:
         python-version: ${{ matrix.python-version }}
         architecture: ${{ matrix.architecture }}
@@ -66,7 +66,7 @@ jobs:
 
     - name: Cache build
       id: build-cache
-      uses: actions/cache@v2
+      uses: actions/cache@937d24475381cd9c75ae6db12cb4e79714b926ed
       with:
         path: winbuild\build
         key:
@@ -159,7 +159,7 @@ jobs:
       shell: bash
 
     - name: Upload errors
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8
       if: failure()
       with:
         name: errors
@@ -171,7 +171,7 @@ jobs:
       shell: pwsh
 
     - name: Upload coverage
-      uses: codecov/codecov-action@v3
+      uses: codecov/codecov-action@29386c70ef20e286228c72b668a06fd0e8399192
       with:
         file: ./coverage.xml
         flags: GHA_Windows
@@ -185,7 +185,7 @@ jobs:
         winbuild\\build\\build_pillow.cmd --disable-imagequant bdist_wheel
       shell: cmd
 
-    - uses: actions/upload-artifact@v3
+    - uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8
       if: "github.event_name != 'pull_request'"
       with:
         name: ${{ steps.wheel.outputs.dist }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 7efd4651562..f69720de338 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -35,10 +35,10 @@ jobs:
     name: ${{ matrix.os }} Python ${{ matrix.python-version }}
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
 
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v3
+      uses: actions/setup-python@98f2ad02fd48d057ee3b4d4f66525b231c3e52b6
       with:
         python-version: ${{ matrix.python-version }}
         cache: pip
@@ -85,7 +85,7 @@ jobs:
         mkdir -p Tests/errors
 
     - name: Upload errors
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8
       if: failure()
       with:
         name: errors
@@ -102,7 +102,7 @@ jobs:
         .ci/after_success.sh
 
     - name: Upload coverage
-      uses: codecov/codecov-action@v3
+      uses: codecov/codecov-action@29386c70ef20e286228c72b668a06fd0e8399192
       with:
         file: ./coverage.xml
         flags: ${{ matrix.os == 'macos-latest' && 'GHA_macOS' || 'GHA_Ubuntu' }}
diff --git a/.github/workflows/tidelift.yml b/.github/workflows/tidelift.yml
index c73f254313d..a308edb58f9 100644
--- a/.github/workflows/tidelift.yml
+++ b/.github/workflows/tidelift.yml
@@ -22,9 +22,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
       - name: Scan
-        uses: tidelift/alignment-action@main
+        uses: tidelift/alignment-action@d0c26f1f22fcc4e831ac1ee859ede3ff898b1ad4
         env:
           TIDELIFT_API_KEY: ${{ secrets.TIDELIFT_API_KEY }}
           TIDELIFT_ORGANIZATION: team/aclark4life