diff --git a/.gitea/workflows/CI.yaml b/.gitea/workflows/CI.yaml
index 58ccd82..dabd80b 100644
--- a/.gitea/workflows/CI.yaml
+++ b/.gitea/workflows/CI.yaml
@@ -10,15 +10,15 @@ jobs:
   build:
     runs-on: ubuntu-latest
     container:
-      image: git.kjan.de/actions/rust-node:latest
+      image: git.kjan.de/actions/rust-node:latest@sha256:49fb2dad7814507334a38ea36ec2852a552cebc5b421ec22295d8a01421cd435
       credentials:
         username: ${{ gitea.actor }}
         password: ${{ gitea.token }}
     steps:
       - name: Checkout
-        uses: https://git.kjan.de/actions/checkout@v4
+        uses: https://git.kjan.de/actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
       - name: ⚡ Cache
-        uses: https://git.kjan.de/actions/cache@v4
+        uses: https://git.kjan.de/actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4
         with:
           path: |
             ~/.cargo/registry
@@ -30,7 +30,7 @@ jobs:
       - name: Build
         run: cargo build --release
       - name: Upload artifacts
-        uses: https://git.kjan.de/actions/upload-artifact@v3
+        uses: https://git.kjan.de/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3
         with:
           name: build
           path: target/release/passwd-cooker