diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml
index 773cb76..0f793ef 100644
--- a/.github/workflows/cla.yml
+++ b/.github/workflows/cla.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check CLA
-        uses: conda/actions/check-cla@v24.2.0
+        uses: conda/actions/check-cla@f46142e89fa703cc69f0421ca1d313ab2d5bfff6
         with:
           # [required]
           # A token with ability to comment, label, and modify the commit status
diff --git a/.github/workflows/issues.yml b/.github/workflows/issues.yml
index 52b1cfe..8391b0e 100644
--- a/.github/workflows/issues.yml
+++ b/.github/workflows/issues.yml
@@ -24,12 +24,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # remove [pending::feedback]
-      - uses: actions-ecosystem/action-remove-labels@v1.3.0
+      - uses: actions-ecosystem/action-remove-labels@2ce5d41b4b6aa8503e285553f75ed56e0a40bae0
         with:
           labels: ${{ env.FEEDBACK_LBL }}
           github_token: ${{ secrets.PROJECT_TOKEN }}
       # add [pending::support], if still open
-      - uses: actions-ecosystem/action-add-labels@v1.1.3
+      - uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf
         if: github.event.issue.state == 'open'
         with:
           labels: ${{ env.SUPPORT_LBL }}
diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index 99ec606..d9a19d1 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -20,20 +20,20 @@ jobs:
       GLOBAL: https://raw.githubusercontent.com/conda/infra/main/.github/global.yml
       LOCAL: .github/labels.yml
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - id: has_local
-        uses: andstor/file-existence-action@v3.0.0
+        uses: andstor/file-existence-action@076e0072799f4942c8bc574a82233e1e4d13e9d6
         with:
           files: ${{ env.LOCAL }}
       - name: Global Only
-        uses: EndBug/label-sync@v2.3.3
+        uses: EndBug/label-sync@52074158190acb45f3077f9099fea818aa43f97a
         if: steps.has_local.outputs.files_exists == 'false'
         with:
           config-file: ${{ env.GLOBAL }}
           delete-other-labels: true
           dry-run: ${{ github.event.inputs.dryrun }}
       - name: Global & Local
-        uses: EndBug/label-sync@v2.3.3
+        uses: EndBug/label-sync@52074158190acb45f3077f9099fea818aa43f97a
         if: steps.has_local.outputs.files_exists == 'true'
         with:
           config-file: |
diff --git a/.github/workflows/lock.yml b/.github/workflows/lock.yml
index 7fd6b91..c4294be 100644
--- a/.github/workflows/lock.yml
+++ b/.github/workflows/lock.yml
@@ -18,7 +18,7 @@ jobs:
     if: '!github.event.repository.fork'
     runs-on: ubuntu-latest
     steps:
-      - uses: dessant/lock-threads@v5
+      - uses: dessant/lock-threads@1bf7ec25051fe7c00bdd17e6a7cf3d7bfb7dc771
         with:
           # Number of days of inactivity before a closed issue is locked
           issue-inactive-days: 365
diff --git a/.github/workflows/project.yml b/.github/workflows/project.yml
index 9414366..35a4fcf 100644
--- a/.github/workflows/project.yml
+++ b/.github/workflows/project.yml
@@ -14,7 +14,7 @@ jobs:
     if: '!github.event.repository.fork'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/add-to-project@v1.0.0
+      - uses: actions/add-to-project@2e5cc851ca7162e9eb510e6da6a5c64022e606a7
         with:
           # issues are added to the Planning project
           # PRs are added to the Review project
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 2464e81..cfc9528 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -34,12 +34,12 @@ jobs:
             days-before-issue-stale: 90
             days-before-issue-close: 21
     steps:
-      - uses: conda/actions/read-yaml@v24.2.0
+      - uses: conda/actions/read-yaml@f46142e89fa703cc69f0421ca1d313ab2d5bfff6
         id: read_yaml
         with:
           path: https://raw.githubusercontent.com/conda/infra/main/.github/messages.yml
 
-      - uses: actions/stale@v9
+      - uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e
         id: stale
         with:
           # Only issues with these labels are checked whether they are stale