diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index c6b18df..55a76c2 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -5,13 +5,13 @@ on:
 
 jobs:
   test:
-    container: git.kjan.de/actions/rust-node
+    container: git.kjan.de/actions/rust-node@sha256:49fb2dad7814507334a38ea36ec2852a552cebc5b421ec22295d8a01421cd435
     name: Tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
       - name: ⚡ Cache
-        uses: https://git.kjan.de/actions/cache@v4
+        uses: https://git.kjan.de/actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
         with:
           path: |
             ~/.cargo/registry
@@ -23,13 +23,13 @@ jobs:
       - run: cargo test
   
   can-publish:
-    container: git.kjan.de/actions/rust-node
+    container: git.kjan.de/actions/rust-node@sha256:49fb2dad7814507334a38ea36ec2852a552cebc5b421ec22295d8a01421cd435
     name: Test publish
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
       - name: ⚡ Cache
-        uses: https://git.kjan.de/actions/cache@v4
+        uses: https://git.kjan.de/actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
         with:
           path: |
             ~/.cargo/registry
@@ -45,7 +45,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
       - name: Get current version from Cargo.toml
         id: cargo-version
diff --git a/.gitea/workflows/publish.yaml b/.gitea/workflows/publish.yaml
index c64fd03..0d04226 100644
--- a/.gitea/workflows/publish.yaml
+++ b/.gitea/workflows/publish.yaml
@@ -7,13 +7,13 @@ on:
 
 jobs:
   can-publish:
-    container: git.kjan.de/actions/rust-node
+    container: git.kjan.de/actions/rust-node@sha256:49fb2dad7814507334a38ea36ec2852a552cebc5b421ec22295d8a01421cd435
     name: Test publish
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
       - name: ⚡ Cache
-        uses: https://git.kjan.de/actions/cache@v4
+        uses: https://git.kjan.de/actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
         with:
           path: |
             ~/.cargo/registry