diff --git a/.github/actions/setup-asdf/action.yml b/.github/actions/setup-asdf/action.yml
index a5d2a8782..4fea2a1f8 100644
--- a/.github/actions/setup-asdf/action.yml
+++ b/.github/actions/setup-asdf/action.yml
@@ -8,12 +8,11 @@ runs:
   using: "composite"
   steps:
     - name: Install asdf
-      # TODO: Pin to a SemVer release when one is made
-      uses: asdf-vm/actions/setup@v4
+      uses: asdf-vm/actions/setup@b7bcd026f18772e44fe1026d729e1611cc435d47  # v4.0.1
       with:
         asdf_version: 0.18.0
     - name: Cache asdf plugins
-      uses: actions/cache@v4.2.0
+      uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57  # v4.2.0
       id: asdf-cache
       with:
         path: |
diff --git a/.github/workflows/version.yml b/.github/workflows/version.yml
index 199d48c33..b447a7a3b 100644
--- a/.github/workflows/version.yml
+++ b/.github/workflows/version.yml
@@ -23,7 +23,7 @@ jobs:
       contents: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955  # v4.3.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955  # v4.3.0  # zizmor: ignore[checkout-persist-credentials,artipacked]
         with:
           token: ${{ secrets.PAT_TOKEN || secrets.GITHUB_TOKEN }}
           ref: ${{ github.head_ref }}
@@ -153,7 +153,7 @@ jobs:
       contents: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955  # v4.3.0
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955  # v4.3.0  # zizmor: ignore[checkout-persist-credentials,artipacked]
         with:
           token: ${{ secrets.PAT_TOKEN || secrets.GITHUB_TOKEN }}
           ref: ${{ github.head_ref }}