diff --git a/.github/workflows/comment_resolver.yml b/.github/workflows/comment_resolver.yml
index 24ea8d3c0a..5c3626fa83 100644
--- a/.github/workflows/comment_resolver.yml
+++ b/.github/workflows/comment_resolver.yml
@@ -15,12 +15,12 @@ jobs:
 
       - name: Google Cloud Auth
         id: auth
-        uses: google-github-actions/auth@v2
+        uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed  # v2
         with:
           credentials_json: ${{ secrets.GCP_SA_CREDENTIALS }}
 
       - name: Set up gcloud
-        uses: google-github-actions/setup-gcloud@v2
+        uses: google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f  # v2
 
       - name: Deploy to Cloud Functions
         working-directory: functions/code_generation
diff --git a/.github/workflows/docker-push.yml b/.github/workflows/docker-push.yml
index 6ab31a3f4c..32402b2e0f 100644
--- a/.github/workflows/docker-push.yml
+++ b/.github/workflows/docker-push.yml
@@ -19,7 +19,7 @@ jobs:
       - uses: actions/checkout@v4
       - id: gcp-auth
         name: Google authentication
-        uses: google-github-actions/auth@v2
+        uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed  # v2
         with:
           token_format: "access_token"
           service_account: artifact-writer@${{ vars.GCP_PROJECT_ID }}.iam.gserviceaccount.com
@@ -56,7 +56,7 @@ jobs:
         run: docker pull mozilla/bugbug-http-service-bg-worker:${{ github.event.inputs.image_tag }}
 
       - name: Log in to GAR for push
-        uses: docker/login-action@v2
+        uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc  # v2
         with:
           registry: ${{ vars.GAR_LOCATION }}-docker.pkg.dev
           username: oauth2accesstoken