diff --git a/.gitea/workflows/hugo-content-deployment.yml b/.gitea/workflows/hugo-content-deployment.yml
index ffac9df..5a79aa8 100644
--- a/.gitea/workflows/hugo-content-deployment.yml
+++ b/.gitea/workflows/hugo-content-deployment.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
         with:
           fetch-depth: 1
 
@@ -55,7 +55,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
         with:
           submodules: true
 
@@ -68,7 +68,7 @@ jobs:
           notification_message: "Starting link inspectionn... 🔍"
 
       - name: Install Hugo
-        uses: peaceiris/actions-hugo@v3.0.0
+        uses: peaceiris/actions-hugo@75d2e84710de30f6ff7268e08f310b60ef14033f # v3.0.0
         with:
           hugo-version: "latest"
           # extended: true
@@ -79,7 +79,7 @@ jobs:
           hugo version
 
       - name: Linkinator
-        uses: JustinBeckwith/linkinator-action@v1.11.0
+        uses: JustinBeckwith/linkinator-action@3d5ba091319fa7b0ac14703761eebb7d100e6f6d # v1.11.0
         with:
           paths: .
           serverRoot: ./
@@ -102,7 +102,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
 
       - name: Cache tea CLI
         id: cache-tea
@@ -142,19 +142,19 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
         with:
           submodules: true
 
       - name: Setup Hugo
-        uses: peaceiris/actions-hugo@v3
+        uses: peaceiris/actions-hugo@75d2e84710de30f6ff7268e08f310b60ef14033f # v3
         with:
           hugo-version: "latest"
           extended: true
 
       - name: Setup rsync
         id: setup_rsync
-        uses: GuillaumeFalourd/setup-rsync@v1.2
+        uses: GuillaumeFalourd/setup-rsync@c16d3c9077132c8ee28eb9de74edcb41c0e0e816 # v1.2
         with:
           ssh_key: ${{ secrets.VPS_DEPLOY_KEY }}
 
@@ -177,7 +177,7 @@ jobs:
           rsync -e "ssh -i ${VPS_DEPLOY_KEY} -o StrictHostKeyChecking=no" -avz --progress ./public ${VPS_DEPLOY_USER}@192.168.1.254:${VPS_DEPLOY_DEST}
 
       - name: Restart Hugo Container
-        uses: appleboy/ssh-action@v1.2.2
+        uses: appleboy/ssh-action@2ead5e36573f08b82fbfce1504f1a4b05a647c6f # v1.2.2
         with:
           host: 192.168.1.254
           username: ${{ secrets.HUGO_DEPLOY_USERNAME }}
diff --git a/.gitea/workflows/hugo-translation-deployment.yml b/.gitea/workflows/hugo-translation-deployment.yml
index f754dce..731acdf 100644
--- a/.gitea/workflows/hugo-translation-deployment.yml
+++ b/.gitea/workflows/hugo-translation-deployment.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
 
       - name: Gotify Notification
         uses: eikendev/gotify-action@master
@@ -34,7 +34,7 @@ jobs:
           echo "files=$(find content/en -type f -name "*.md" | tr '\n' ' ')" >> $GITHUB_OUTPUT
 
       - name: GPT Translations (es,ko,zh-Hans)
-        uses: 3ru/gpt-translate@v1.2.2 # PR creation happens here
+        uses: 3ru/gpt-translate@6f81acc9116f18f15c4529dee2f58c5fb5fcbb8d # v1.2.2 # PR creation happens here
         with:
           token: ${{ secrets.BOT_GITEA_TOKEN }}
           provider: "openai"
@@ -46,7 +46,7 @@ jobs:
 
       - name: Add/Commit Translations
         id: commit-translations
-        uses: EndBug/add-and-commit@v9
+        uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9
         with:
           message: "Adding translated content..."
           add: "./content/*"
@@ -65,7 +65,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
 
       - name: Gotify Notification
         uses: eikendev/gotify-action@master
@@ -76,7 +76,7 @@ jobs:
           notification_message: "Starting link inspectionn... 🔍"
 
       - name: Install Hugo
-        uses: peaceiris/actions-hugo@v3.0.0
+        uses: peaceiris/actions-hugo@75d2e84710de30f6ff7268e08f310b60ef14033f # v3.0.0
         with:
           hugo-version: "latest"
           extended: true
@@ -87,7 +87,7 @@ jobs:
           hugo version
 
       - name: Linkinator
-        uses: JustinBeckwith/linkinator-action@v1.11.0
+        uses: JustinBeckwith/linkinator-action@3d5ba091319fa7b0ac14703761eebb7d100e6f6d # v1.11.0
         with:
           paths: .
           serverRoot: ./
@@ -110,7 +110,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
 
       - name: Cache tea CLI
         id: cache-tea
@@ -150,19 +150,19 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
         with:
           submodules: true
 
       - name: Setup Hugo
-        uses: peaceiris/actions-hugo@v3
+        uses: peaceiris/actions-hugo@75d2e84710de30f6ff7268e08f310b60ef14033f # v3
         with:
           hugo-version: "latest"
           extended: true
 
       - name: Setup rsync
         id: setup_rsync
-        uses: GuillaumeFalourd/setup-rsync@v1.2
+        uses: GuillaumeFalourd/setup-rsync@c16d3c9077132c8ee28eb9de74edcb41c0e0e816 # v1.2
         with:
           ssh_key: ${{ secrets.VPS_DEPLOY_KEY }}
 
@@ -187,7 +187,7 @@ jobs:
           rsync -e "ssh -i ${VPS_DEPLOY_KEY} -o StrictHostKeyChecking=no" -avz --progress ./public ${VPS_DEPLOY_USER}@192.168.1.254:${VPS_DEPLOY_DEST}
 
       - name: Restart Hugo Container
-        uses: appleboy/ssh-action@v1.2.2
+        uses: appleboy/ssh-action@2ead5e36573f08b82fbfce1504f1a4b05a647c6f # v1.2.2
         with:
           host: 192.168.1.254
           username: ${{ secrets.HUGO_DEPLOY_USERNAME }}