diff --git a/.github/workflows/pxt-buildpush.yml b/.github/workflows/pxt-buildpush.yml
index 65d8d412d1..6eedb448d0 100644
--- a/.github/workflows/pxt-buildpush.yml
+++ b/.github/workflows/pxt-buildpush.yml
@@ -34,13 +34,13 @@ jobs:
     needs: tag-bump-commit
     if: always() && fromJSON(needs.tag-bump-commit.outputs.did_tag || 'false') == false
     steps:
-      - uses: actions/checkout@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           fetch-tags: true
 
       - name: Use Node.js
-        uses: actions/setup-node@main
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 20.x
 
@@ -79,13 +79,13 @@ jobs:
     needs: tag-bump-commit
     if: always() && fromJSON(needs.tag-bump-commit.outputs.did_tag || 'false') == true
     steps:
-      - uses: actions/checkout@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           fetch-tags: true
 
       - name: Use Node.js
-        uses: actions/setup-node@main
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 20.x
 
@@ -119,7 +119,7 @@ jobs:
           PXT_SKIP_GIT_COMMIT: true
 
       - name: Clone release repo
-        uses: actions/checkout@main
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ secrets.BUILT_REPO_NAME }}
           path: tmp/releases/release
diff --git a/.github/workflows/pxt-buildvtag.yml b/.github/workflows/pxt-buildvtag.yml
index e81b3eae04..2cc58f1616 100644
--- a/.github/workflows/pxt-buildvtag.yml
+++ b/.github/workflows/pxt-buildvtag.yml
@@ -16,13 +16,13 @@ jobs:
     if: fromJSON(needs.filter-vtags.outputs.is_vtag || 'false') == true
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@main
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           fetch-tags: true
 
       - name: Use Node.js
-        uses: actions/setup-node@main
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 18.x