diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 218e5e1..fa86044 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -30,7 +30,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: shivammathur/setup-php@v2
+      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.4'
           tools: composer:v2
diff --git a/.github/workflows/qa.yml b/.github/workflows/qa.yml
index d769a5c..86f65d7 100644
--- a/.github/workflows/qa.yml
+++ b/.github/workflows/qa.yml
@@ -57,7 +57,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: shivammathur/setup-php@v2
+      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.4'
           tools: composer:v2
@@ -76,7 +76,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: shivammathur/setup-php@v2
+      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.4'
           tools: composer:v2
@@ -104,7 +104,7 @@ jobs:
         dependency-preference: ['prefer-lowest', 'prefer-stable']
     steps:
       - uses: actions/checkout@v4
-      - uses: shivammathur/setup-php@v2
+      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: ${{ matrix.php-version }}
           tools: composer:v2
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9126e1b..76fad6e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -25,7 +25,7 @@ jobs:
         with:
           node-version: 'lts/*'
 
-      - uses: shivammathur/setup-php@v2
+      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.4'
           tools: composer:v2
diff --git a/.github/workflows/split.yml b/.github/workflows/split.yml
index 79ed188..b2fc2da 100644
--- a/.github/workflows/split.yml
+++ b/.github/workflows/split.yml
@@ -31,7 +31,7 @@ jobs:
           fetch-depth: 0
 
       - if: "!startsWith(github.ref, 'refs/tags/')"
-        uses: danharrin/monorepo-split-github-action@v2.4.4
+        uses: danharrin/monorepo-split-github-action@f10477258c88013cc5902388ec47fe9457837041 # v2.4.4
         with:
           package_directory: ${{ matrix.package.local_path }}
           repository_organization: 'convertcom'
@@ -40,7 +40,7 @@ jobs:
           user_email: 'ci@convert.com'
 
       - if: "startsWith(github.ref, 'refs/tags/')"
-        uses: danharrin/monorepo-split-github-action@v2.4.4
+        uses: danharrin/monorepo-split-github-action@f10477258c88013cc5902388ec47fe9457837041 # v2.4.4
         with:
           tag: ${{ github.ref_name }}
           package_directory: ${{ matrix.package.local_path }}