diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5875ad40..24ba74b9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -64,9 +64,9 @@ jobs:
     name: fmt
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Setup Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@e701504024f229986b6bc21544a47a1ec68d0ee5 # stable
         with:
           components: rustfmt
       - name: Run fmt
@@ -76,9 +76,9 @@ jobs:
     name: clippy
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Setup Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@e701504024f229986b6bc21544a47a1ec68d0ee5 # stable
         with:
           components: clippy
           targets: wasm32v1-none
@@ -101,9 +101,9 @@ jobs:
     name: test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Setup Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@e701504024f229986b6bc21544a47a1ec68d0ee5 # stable
         with:
           targets: wasm32v1-none
       - name: Cache cargo
@@ -125,9 +125,9 @@ jobs:
     name: benchmark-budgets
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Setup Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@e701504024f229986b6bc21544a47a1ec68d0ee5 # stable
         with:
           targets: wasm32v1-none
       - name: Cache cargo