diff --git a/.gitea/workflows/ovos-compose-upstream.yml b/.gitea/workflows/ovos-compose-upstream.yml
index a6770df..a2d5df6 100644
--- a/.gitea/workflows/ovos-compose-upstream.yml
+++ b/.gitea/workflows/ovos-compose-upstream.yml
@@ -12,7 +12,7 @@ jobs:
     steps:
       # Step 1: Checkout the repo
       - name: Checkout benedikta-ovos
-        uses: actions/checkout@v3
+        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # v3.0.2
 
       - name: Sync compose from ovos-docker
         run: |
@@ -22,7 +22,7 @@ jobs:
           ./update-sync-ovos-compose.sh
 
       - name: Commit & push changes
-        uses: EndBug/add-and-commit@v9
+        uses: EndBug/add-and-commit@998652d28d7702d095d40f52ae42982a80ae8c7d # v9.0.1
         with:
           add: "compose"
           message: "Update compose/ from ovos-docker:dev"