diff --git a/.github/workflows/automate_issue_labels.yml b/.github/workflows/automate_issue_labels.yml
index bbffa4f7b8..b4a5d0f655 100644
--- a/.github/workflows/automate_issue_labels.yml
+++ b/.github/workflows/automate_issue_labels.yml
@@ -13,7 +13,7 @@ jobs:
 
     steps:
       - name: Remove needs:triage label
-        uses: actions-ecosystem/action-remove-labels@v1
+        uses: actions-ecosystem/action-remove-labels@2ce5d41b4b6aa8503e285553f75ed56e0a40bae0 # v1
         if: ${{ startsWith(github.event.label.name, 'priority:') || ( startsWith(github.event.label.name, 'needs:') && github.event.label.name != 'needs:triage' ) }}
         with:
           labels: needs:triage
diff --git a/.github/workflows/issue.yaml b/.github/workflows/issue.yaml
index 46ff8a6011..50d0e4ceb0 100644
--- a/.github/workflows/issue.yaml
+++ b/.github/workflows/issue.yaml
@@ -22,7 +22,7 @@ jobs:
 
       # We need to checkout the `.github/ISSUE_TEMPLATE` for the advanced labeler action to be able to read the templates
       # While at it we might as well checkout all of `.github` so that the labeling actions don't need to fetch their configs
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           sparse-checkout: .github
 
@@ -38,12 +38,12 @@ jobs:
 
       # These two steps add labels based on user input in the issue form
       - name: Parse issue form
-        uses: stefanbuck/github-issue-parser@v3
+        uses: stefanbuck/github-issue-parser@2ea9b35a8c584529ed00891a8f7e41dc46d0441e # v3
         id: issue-parser
         with:
           template-path: .github/ISSUE_TEMPLATE/.common.yaml
       - name: Add advanced issue labels
-        uses: redhat-plumbers-in-action/advanced-issue-labeler@v2
+        uses: redhat-plumbers-in-action/advanced-issue-labeler@9e55064634b67244f7deb4211452b4a7217b93de # v2
         with:
           issue-form: ${{ steps.issue-parser.outputs.jsonString }}
           token: ${{ secrets.GITHUB_TOKEN }}