diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0409951..4dc3fae 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
       - name: Check formating
         run: cargo --locked fmt --check
       - name: Check code style
@@ -24,14 +24,14 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
       - name: Install nextest
         uses: taiki-e/install-action@nextest
       - name: Install cargo-llvm-cov
         uses: taiki-e/install-action@cargo-llvm-cov
       - name: Run tests with coverage
         run: cargo --locked llvm-cov nextest
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4
         if: success() || failure()
         with:
           name: junit.xml
diff --git a/.github/workflows/junit-report.yml b/.github/workflows/junit-report.yml
index 7ad6fb1..7ecd606 100644
--- a/.github/workflows/junit-report.yml
+++ b/.github/workflows/junit-report.yml
@@ -16,8 +16,8 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+      - uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4
         with:
           github-token: ${{secrets.GITHUB_TOKEN}}
           name: junit.xml
diff --git a/Cargo.toml b/Cargo.toml
index 7d0de54..8d7aaca 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -10,10 +10,10 @@ categories = ["command-line-utilities"]
 publish = false
 
 [dependencies]
-chrono = { version = "0.4.37", default-features = false }
-color-eyre = { version = "0.6.3", default-features = false, features = ["track-caller"] }
-gix = { version = "0.61.0", default-features = false, features = ["interrupt", "worktree-mutation", "blocking-http-transport-reqwest-rust-tls"] }
-nom = "7.1.3"
+chrono = { version = "=0.4.37", default-features = false }
+color-eyre = { version = "=0.6.3", default-features = false, features = ["track-caller"] }
+gix = { version = "=0.61.0", default-features = false, features = ["interrupt", "worktree-mutation", "blocking-http-transport-reqwest-rust-tls"] }
+nom = "=7.1.3"
 
 [dev-dependencies]
 indoc = "2.0.5"