diff --git a/.gitea/workflows/dag-config-check.yml b/.gitea/workflows/dag-config-check.yml
index a2c2336..585ae8d 100644
--- a/.gitea/workflows/dag-config-check.yml
+++ b/.gitea/workflows/dag-config-check.yml
@@ -49,7 +49,7 @@ jobs:
           vault_version: 1.18.0
 
       - name: Cache pip
-        uses: actions/cache@v4
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
         with:
           path: ~/.cache/pip
           key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements*.txt') }}
diff --git a/.gitea/workflows/gitea_tar-valon_ansible_deploy.yml b/.gitea/workflows/gitea_tar-valon_ansible_deploy.yml
index 9eb390f..105ace2 100644
--- a/.gitea/workflows/gitea_tar-valon_ansible_deploy.yml
+++ b/.gitea/workflows/gitea_tar-valon_ansible_deploy.yml
@@ -109,7 +109,7 @@ jobs:
           vault_version: 1.18.0
 
       - name: Cache pip
-        uses: actions/cache@v4
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
         with:
           path: ~/.cache/pip
           key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements*.txt') }}
@@ -215,7 +215,7 @@ jobs:
           vault_version: 1.18.0
 
       - name: Cache pip
-        uses: actions/cache@v4
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
         with:
           path: ~/.cache/pip
           key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements*.txt') }}
diff --git a/.gitea/workflows/vault-auto-unseal-flow.yml b/.gitea/workflows/vault-auto-unseal-flow.yml
index 17e5b73..13c5183 100644
--- a/.gitea/workflows/vault-auto-unseal-flow.yml
+++ b/.gitea/workflows/vault-auto-unseal-flow.yml
@@ -28,7 +28,7 @@ jobs:
 
       - name: Cache Vault install
         id: cache-vault
-        uses: actions/cache@v4
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
         with:
           path: /opt/hostedtoolcache/vault/${{ env.HC_VAULT_VERSION }}/x64
           key: vault-${{ runner.os }}-${{ env.HC_VAULT_VERSION }}