diff --git a/.github/workflows/test-fma-darwin.yml b/.github/workflows/test-fma-darwin.yml
index 7cbc12159b..87d614498b 100644
--- a/.github/workflows/test-fma-darwin.yml
+++ b/.github/workflows/test-fma-darwin.yml
@@ -31,7 +31,7 @@ jobs:
 
     steps:
       - name: Checkout Fleet
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
           repository: fleetdm/fleet
           fetch-depth: 1
@@ -39,7 +39,7 @@ jobs:
           path: fleet
       
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5  # v5.5.0
         with:
           go-version-file: 'fleet/go.mod'
 
diff --git a/.github/workflows/test-fma-windows.yml b/.github/workflows/test-fma-windows.yml
index 43168e8107..9477dd998d 100644
--- a/.github/workflows/test-fma-windows.yml
+++ b/.github/workflows/test-fma-windows.yml
@@ -31,7 +31,7 @@ jobs:
 
     steps:
       - name: Checkout Fleet
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
           repository: fleetdm/fleet
           fetch-depth: 1
@@ -39,7 +39,7 @@ jobs:
           path: fleet
       
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5  # v5.5.0
         with:
           go-version-file: 'fleet/go.mod'