diff --git a/.github/workflows/license-check.yml b/.github/workflows/license-check.yml
index d57766a..7eeb68f 100644
--- a/.github/workflows/license-check.yml
+++ b/.github/workflows/license-check.yml
@@ -7,6 +7,6 @@ jobs:
   license:
     runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@master
+    - uses: actions/checkout@61b9e3751b92087fd0b06925ba6dd6314e06f089 # master
     - name: Check License Header
       uses: apache/skywalking-eyes/header@55373684d1b70e5f8fd9fc8ec114a89ad11a56a3
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 7a4b37e..beeab3b 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -12,7 +12,7 @@ jobs:
       - run: |
             rustup toolchain install
 
-      - uses: michaelkaye/setup-matrix-synapse@main
+      - uses: michaelkaye/setup-matrix-synapse@e080023c56271cab986b83db75edba570fafb88b # main
         with:
           uploadLogs: true
           httpPort: 8008