diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 24050066..6027125f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -240,7 +240,7 @@ jobs:
       - name: 'Check out test suite'
         run: 'git clone --depth=1 https://github.com/upx/upx-testsuite ../deps/upx-testsuite'
       - name: 'Set up Developer Command Prompt'
-        uses: ilammy/msvc-dev-cmd@v1
+        uses: ilammy/msvc-dev-cmd@cec98b9d092141f74527d0afa6feb2af698cfe89 # v1.12.1
         with:
           vsversion: ${{ matrix.vsversion }}
           arch: ${{ matrix.arch }}
@@ -305,7 +305,7 @@ jobs:
           git clone --depth=1 https://github.com/upx/upx-testsuite ../deps/upx-testsuite
           mkdir -p -v build/$C/$B/{bzip2,ucl,upx,zlib,zstd}
       - name: 'Set up Developer Command Prompt'
-        uses: ilammy/msvc-dev-cmd@v1
+        uses: ilammy/msvc-dev-cmd@cec98b9d092141f74527d0afa6feb2af698cfe89 # v1.12.1
         with:
           vsversion: ${{ matrix.vsversion }}
           arch: ${{ matrix.arch }}
diff --git a/.github/workflows/misc-spell-check.yml b/.github/workflows/misc-spell-check.yml
index ec8040f2..71f25feb 100644
--- a/.github/workflows/misc-spell-check.yml
+++ b/.github/workflows/misc-spell-check.yml
@@ -17,5 +17,5 @@ jobs:
         uses: actions/checkout@v4
         with: { submodules: false }
       - name: 'Spell check with crate-ci/typos'
-        uses: crate-ci/typos@master
+        uses: crate-ci/typos@35a8bc67870d6c0b7407683319ae175577e24261 # v1.16.19
         with: { config: ./.github/typos_config.toml }
diff --git a/.github/workflows/test-cmake-default.yml b/.github/workflows/test-cmake-default.yml
index af2977ed..96a9b74c 100644
--- a/.github/workflows/test-cmake-default.yml
+++ b/.github/workflows/test-cmake-default.yml
@@ -54,7 +54,7 @@ jobs:
         uses: actions/checkout@v4
         with: { submodules: true }
       - name: 'Set up Developer Command Prompt'
-        uses: ilammy/msvc-dev-cmd@v1
+        uses: ilammy/msvc-dev-cmd@cec98b9d092141f74527d0afa6feb2af698cfe89 # v1.12.1
         with:
           vsversion: 2022
           arch: amd64
@@ -103,7 +103,7 @@ jobs:
         uses: actions/checkout@v4
         with: { submodules: true }
       - name: 'Set up Developer Command Prompt'
-        uses: ilammy/msvc-dev-cmd@v1
+        uses: ilammy/msvc-dev-cmd@cec98b9d092141f74527d0afa6feb2af698cfe89 # v1.12.1
         with:
           vsversion: 2022
           arch: amd64
diff --git a/.github/workflows/weekly-ci-bs-cmake-windows-make.yml b/.github/workflows/weekly-ci-bs-cmake-windows-make.yml
index 30969de4..12d0f10e 100644
--- a/.github/workflows/weekly-ci-bs-cmake-windows-make.yml
+++ b/.github/workflows/weekly-ci-bs-cmake-windows-make.yml
@@ -44,7 +44,7 @@ jobs:
         with: { submodules: true }
       - name: 'Set up Developer Command Prompt'
         if: matrix.vsversion
-        uses: ilammy/msvc-dev-cmd@v1
+        uses: ilammy/msvc-dev-cmd@cec98b9d092141f74527d0afa6feb2af698cfe89 # v1.12.1
         with:
           vsversion: ${{ matrix.vsversion }}
           arch: ${{ matrix.arch }}
diff --git a/.github/workflows/weekly-ci-bs-cmake-windows-ninja.yml b/.github/workflows/weekly-ci-bs-cmake-windows-ninja.yml
index f9afb241..ac3d466f 100644
--- a/.github/workflows/weekly-ci-bs-cmake-windows-ninja.yml
+++ b/.github/workflows/weekly-ci-bs-cmake-windows-ninja.yml
@@ -42,7 +42,7 @@ jobs:
         with: { submodules: true }
       - name: 'Set up Developer Command Prompt'
         if: matrix.vsversion
-        uses: ilammy/msvc-dev-cmd@v1
+        uses: ilammy/msvc-dev-cmd@cec98b9d092141f74527d0afa6feb2af698cfe89 # v1.12.1
         with:
           vsversion: ${{ matrix.vsversion }}
           arch: ${{ matrix.arch }}
diff --git a/.github/workflows/weekly-ci-bs-cmake-windows-nmake.yml b/.github/workflows/weekly-ci-bs-cmake-windows-nmake.yml
index ac8d4f0d..f9f377ee 100644
--- a/.github/workflows/weekly-ci-bs-cmake-windows-nmake.yml
+++ b/.github/workflows/weekly-ci-bs-cmake-windows-nmake.yml
@@ -32,7 +32,7 @@ jobs:
         uses: actions/checkout@v4
         with: { submodules: true }
       - name: 'Set up Developer Command Prompt'
-        uses: ilammy/msvc-dev-cmd@v1
+        uses: ilammy/msvc-dev-cmd@cec98b9d092141f74527d0afa6feb2af698cfe89 # v1.12.1
         with:
           vsversion: ${{ matrix.vsversion }}
           arch: ${{ matrix.arch }}