diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 6d394fe..f53e7ba 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -45,13 +45,13 @@ jobs:
       - name: Support longpaths on Windows
         if: "startsWith(matrix.os.runs-on, 'windows')"
         run: git config --global core.longpaths true
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           # Fetch the whole history to make sure that gitflow incremental builder
           # can find the base commit.
           fetch-depth: 0
       - name: Set up Java ${{ matrix.os.java.version }}
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
         with:
           java-version: ${{ matrix.os.java.version }}
           distribution: temurin