diff --git a/.github/workflows/pr-auditor.yml b/.github/workflows/pr-auditor.yml
index 03f531a..e477954 100644
--- a/.github/workflows/pr-auditor.yml
+++ b/.github/workflows/pr-auditor.yml
@@ -9,11 +9,11 @@ jobs:
   check-pr:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           repository: 'sourcegraph/devx-service'
           token: ${{ secrets.PR_AUDITOR_TOKEN }}
-      - uses: actions/setup-go@v4
+      - uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4.3.0
         with: { go-version: '1.22' }
 
       - run: 'go run ./cmd/pr-auditor'
@@ -24,5 +24,5 @@ jobs:
   report_failure:
     needs: check-pr
     if: ${{ failure() }}
-    uses: sourcegraph/sourcegraph/.github/workflows/report-job-failure.yml@main
+    uses: sourcegraph/sourcegraph/.github/workflows/report-job-failure.yml@e144b26f9ea91494a4712311eec78b92d0796864 # main
     secrets: inherit