diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index fb140cb..6b1aa7d 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -11,10 +11,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Use Node.js LTS
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version-file: .nvmrc
 
diff --git a/.github/workflows/profanity.yml b/.github/workflows/profanity.yml
index 2795323..910401d 100644
--- a/.github/workflows/profanity.yml
+++ b/.github/workflows/profanity.yml
@@ -23,7 +23,7 @@ jobs:
     - name: Scan issue or pull request for profanity
       # Conditionally run the step if the actor isn't a bot
       if: ${{ github.actor != 'dependabot[bot]' && github.actor != 'github-actions[bot]' }}
-      uses: IEvangelist/profanity-filter@main
+      uses: IEvangelist/profanity-filter@96fb7c017b3219ea65c6a7ca70e5aed3ce5b4d7d # 13.4.6.2
       id: profanity-filter
       with:
         token: ${{ secrets.GITHUB_TOKEN }}