diff --git a/.github/workflows/auto-assign.yaml b/.github/workflows/auto-assign.yaml
index 652eaebe4..3f351b83d 100644
--- a/.github/workflows/auto-assign.yaml
+++ b/.github/workflows/auto-assign.yaml
@@ -9,4 +9,4 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Assign author to assignee on PR
-        uses: technote-space/assign-author@v1
+        uses: technote-space/assign-author@9558557c5c4816f38bd06176fbc324ba14bb3160 # v1
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 88c902889..328ffbb5a 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
       - name: Install Rust nightly
         run: rustup toolchain install nightly-2026-07-20