diff --git a/.github/workflows/fossa.yaml b/.github/workflows/fossa.yaml
index 01f3c67..d16cbd6 100644
--- a/.github/workflows/fossa.yaml
+++ b/.github/workflows/fossa.yaml
@@ -11,10 +11,10 @@ jobs:
     if: github.repository_owner == 'uber-go'
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2 # v4.0.0
 
       - name: FOSSA analysis
-        uses: fossas/fossa-action@v1
+        uses: fossas/fossa-action@f61a4c0c263690f2ddb54b9822a719c25a7b608f # v1.0.0
         with:
           api-key: ${{ secrets.FOSSA_API_KEY }}