diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 241ffd6..487d633 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -9,15 +9,15 @@ jobs:
     if: "!contains(github.event.head_commit.message, 'ci skip')"
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v5.0.1
         with:
           fetch-depth: 0
-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@v5.3.0
         with:
           java-version: 17.0.13
           distribution: liberica
       - name: Cache Maven dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@v4.3.0
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
@@ -28,6 +28,6 @@ jobs:
       - name: Run maven build
         run: mvn package -PprettierCheck -Dprettier.nodePath=node -Dprettier.npmPath=npm
       - name: codecov
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v5.5.5
         with:
            files: ./target/site/jacoco/jacoco.xml
diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index ff41587..d6329e9 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -17,18 +17,18 @@ jobs:
     if: "!contains(github.event.head_commit.message, 'ci skip')"
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v5.0.1
         with:
           fetch-depth: 0
       - name: Copy maven settings
         run: |
           wget https://raw.githubusercontent.com/entur/ror-maven-settings/master/.m2/settings_release_maven_central.xml -O .github/workflows/settings.xml
-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@v5.3.0
         with:
           java-version: 17.0.13
           distribution: liberica
       - name: Cache Maven dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@v4.3.0
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
@@ -62,7 +62,7 @@ jobs:
   publish-release:
     if: github.repository_owner == 'entur' && github.event_name == 'push'
     name: Publish release to maven central
-    uses: entur/gha-maven-central/.github/workflows/maven-publish.yml@v1
+    uses: entur/gha-maven-central/.github/workflows/maven-publish.yml@v1.3.1
     secrets: inherit
     with:
       push_to_repo: true