diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index e24164e..db0fba1 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -16,7 +16,7 @@ jobs:
       contents: write
       pull-requests: write
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
     - name: Update repo
       run: |
         . ./update.sh
@@ -26,7 +26,7 @@ jobs:
         export RELEASE=$(git for-each-ref --format="%(refname:short)" --sort=-authordate --count=1 refs/tags || true)
         rm -rf github-action
         echo "release=${RELEASE}" >> $GITHUB_ENV
-    - uses: peter-evans/create-pull-request@v4
+    - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
       if: env.latest != env.current
       with:
         add-paths: |