diff --git a/.gitea/workflows/pr-docker-deploy.yml b/.gitea/workflows/pr-docker-deploy.yml
index 7c8a233..bec0caa 100644
--- a/.gitea/workflows/pr-docker-deploy.yml
+++ b/.gitea/workflows/pr-docker-deploy.yml
@@ -27,13 +27,13 @@ jobs:
 
       - name: Cache tea CLI
         id: cache-tea
-        uses: actions/cache@v4
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
         with:
           path: /opt/hostedtoolcache/tea/${{ env.TEA_VERSION }}/x64
           key: tea-${{ runner.os }}-${{ env.TEA_VERSION }}
 
       - name: Install tea
-        uses: supplypike/setup-bin@v4
+        uses: supplypike/setup-bin@8e3f88b4f143d9b5c3497f0fc12d45c83c123787 # v4.0.1
         with:
           uri: https://gitea.com/gitea/tea/releases/download/v${{ env.TEA_VERSION }}/tea-${{ env.TEA_VERSION }}-linux-amd64
           name: tea
@@ -198,7 +198,7 @@ jobs:
 
       - name: Cache Vault install
         id: cache-vault
-        uses: actions/cache@v4
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
         with:
           path: /opt/hostedtoolcache/vault/${{ env.HC_VAULT_VERSION }}/x64
           key: vault-${{ runner.os }}-${{ env.HC_VAULT_VERSION }}
@@ -269,13 +269,13 @@ jobs:
 
       - name: Cache tea CLI
         id: cache-tea
-        uses: actions/cache@v4
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
         with:
           path: /opt/hostedtoolcache/tea/${{ env.TEA_VERSION }}/x64
           key: tea-${{ runner.os }}-${{ env.TEA_VERSION }}
 
       - name: Install tea
-        uses: supplypike/setup-bin@v4
+        uses: supplypike/setup-bin@8e3f88b4f143d9b5c3497f0fc12d45c83c123787 # v4.0.1
         with:
           uri: https://gitea.com/gitea/tea/releases/download/v${{ env.TEA_VERSION }}/tea-${{ env.TEA_VERSION }}-linux-amd64
           name: tea
@@ -315,7 +315,7 @@ jobs:
 
       - name: Cache Vault install
         id: cache-vault
-        uses: actions/cache@v4
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
         with:
           path: /opt/hostedtoolcache/vault/${{ env.HC_VAULT_VERSION }}/x64
           key: vault-${{ runner.os }}-${{ env.HC_VAULT_VERSION }}