diff --git a/.github/workflows/tag-and-release.yml b/.github/workflows/tag-and-release.yml
index f5ab2b93f..aec331dc4 100644
--- a/.github/workflows/tag-and-release.yml
+++ b/.github/workflows/tag-and-release.yml
@@ -15,7 +15,7 @@ jobs:
     steps:
       - name: Create release tag
         id: tag
-        uses: google-github-actions/release-please-action@v3
+        uses: google-github-actions/release-please-action@db8f2c60ee802b3748b512940dde88eabd7b7e01 # v3
         with:
           command: manifest # use configs in release-please-config.json
       - id: release-flag
@@ -38,7 +38,7 @@ jobs:
         uses: ./.github/actions/setup
 
       - name: Login to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3
         with:
           registry: ghcr.io
           username: dummy