diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1bf949cc..3087ad72 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -107,7 +107,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - name: Setup Node.js
-        uses: actions/setup-node@v4.0.2
+        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
         with:
           node-version: 'lts/*'
       - name: Semantic Release
diff --git a/.gitlab/workflows/ci.yml b/.gitlab/workflows/ci.yml
index cb5cacbd..005c6017 100644
--- a/.gitlab/workflows/ci.yml
+++ b/.gitlab/workflows/ci.yml
@@ -45,7 +45,7 @@ consistency:
   stage: ci
 semantic-release:
   image:
-    name: node:20.13.1
+    name: node:20.13.1@sha256:d6925dc84f8c0d1c1f8df4ea6a9a54e57d430241cb734b1b0c45ed6d26e8e9c0
   interruptible: true
   rules:
     - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE == "push" && $CI_PROJECT_NAMESPACE == "serious-scaffold" && $CI_PROJECT_NAME == "ss-python" && $GITLAB_TOKEN != null
diff --git a/template/[% if repo_platform == 'github' %].github[% endif %]/workflows/ci.yml.jinja b/template/[% if repo_platform == 'github' %].github[% endif %]/workflows/ci.yml.jinja
index f82d2f08..94900252 100644
--- a/template/[% if repo_platform == 'github' %].github[% endif %]/workflows/ci.yml.jinja	
+++ b/template/[% if repo_platform == 'github' %].github[% endif %]/workflows/ci.yml.jinja	
@@ -138,7 +138,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - name: Setup Node.js
-        uses: actions/setup-node@v4.0.2
+        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
         with:
           node-version: 'lts/*'
       - name: Semantic Release
diff --git a/template/[% if repo_platform == 'gitlab' or repo_platform == 'gitlab-self-managed' %].gitlab[% endif %]/workflows/ci.yml.jinja b/template/[% if repo_platform == 'gitlab' or repo_platform == 'gitlab-self-managed' %].gitlab[% endif %]/workflows/ci.yml.jinja
index 39fca9a6..4089a610 100644
--- a/template/[% if repo_platform == 'gitlab' or repo_platform == 'gitlab-self-managed' %].gitlab[% endif %]/workflows/ci.yml.jinja	
+++ b/template/[% if repo_platform == 'gitlab' or repo_platform == 'gitlab-self-managed' %].gitlab[% endif %]/workflows/ci.yml.jinja	
@@ -58,7 +58,7 @@ consistency:
 [%- endif %]
 semantic-release:
   image:
-    name: node:20.13.1
+    name: node:20.13.1@sha256:d6925dc84f8c0d1c1f8df4ea6a9a54e57d430241cb734b1b0c45ed6d26e8e9c0
   interruptible: true
   rules:
     - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE == "push" && $CI_PROJECT_NAMESPACE == "{{ repo_namespace }}" && $CI_PROJECT_NAME == "{{ repo_name }}" && $GITLAB_TOKEN != null