diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9132c2a84fc..baebc762d1d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,11 +15,11 @@ jobs:
     env:
       RUSTFLAGS: -D warnings
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: rustfmt, clippy
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@a95ba195448af2da9b00fb742d14ffaaf3c21f43 # v2
       - name: Lint (clippy)
         run: cargo clippy --all-features --all-targets
       - name: Install cargo-hack
@@ -29,7 +29,7 @@ jobs:
       - name: Lint (rustfmt)
         run: cargo xfmt --check
       - name: Install cargo readme
-        uses: baptiste0928/cargo-install@v1
+        uses: baptiste0928/cargo-install@2cfb0024938d23011106cbf127b393bc83fddba1 # v1
         with:
           crate: cargo-readme
       - name: Run cargo readme
@@ -48,11 +48,11 @@ jobs:
     env:
       RUSTFLAGS: -D warnings
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
       - uses: dtolnay/rust-toolchain@master
         with:
           toolchain: ${{ matrix.rust-version }}
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@a95ba195448af2da9b00fb742d14ffaaf3c21f43 # v2
 
       # Build all packages we care about one by one to ensure feature unification
       # doesn't happen.
@@ -87,11 +87,11 @@ jobs:
     env:
       RUSTFLAGS: -D warnings
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
       - uses: dtolnay/rust-toolchain@master
         with:
           toolchain: ${{ matrix.rust-version }}
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@a95ba195448af2da9b00fb742d14ffaaf3c21f43 # v2
       - name: Build
         # Build all targets to ensure examples are built as well.
         # Exclude cargo-compare so that it only runs on the cfg-expr version below.
@@ -113,7 +113,7 @@ jobs:
     env:
       RUSTDOCFLAGS: -D warnings
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
       - uses: dtolnay/rust-toolchain@stable
       # Note: caching doesn't appear to work for rustdoc as of 2022-12-04, and we're exceeding cache
       # sizes anyway
@@ -134,10 +134,10 @@ jobs:
       RUSTFLAGS: -D warnings
       PROPTEST_MULTIPLIER: 64
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
       # This matches the cfg-expr version.
       - uses: dtolnay/rust-toolchain@1.70.0
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@a95ba195448af2da9b00fb742d14ffaaf3c21f43 # v2
       - name: Build and test
         run: cargo test --package cargo-compare --release
 
@@ -147,13 +147,13 @@ jobs:
     env:
       RUSTFLAGS: -D warnings
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
       - uses: dtolnay/rust-toolchain@stable
         with:
           targets: aarch64-unknown-linux-gnu
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@a95ba195448af2da9b00fb742d14ffaaf3c21f43 # v2
       - name: Build
-        uses: actions-rs/cargo@v1
+        uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1
         with:
           use-cross: true
           command: build
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index c448f35ed03..f2aea953884 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -11,7 +11,7 @@ jobs:
     concurrency: ci-${{ github.ref }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
       - uses: dtolnay/rust-toolchain@nightly
       # Note: caching doesn't appear to work for rustdoc as of 2022-12-04, and we're exceeding cache
       # sizes anyway
diff --git a/.github/workflows/hakari.yml b/.github/workflows/hakari.yml
index 3730ebeee48..f5faf4cd4a6 100644
--- a/.github/workflows/hakari.yml
+++ b/.github/workflows/hakari.yml
@@ -17,21 +17,21 @@ jobs:
     env:
       RUSTFLAGS: -D warnings
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions-rs/toolchain@v1
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
+      - uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1
         with:
           toolchain: stable
       - name: Install cargo-hakari
-        uses: taiki-e/install-action@v2
+        uses: taiki-e/install-action@57aaba576a0253b74662df51e62715622f02127b # v2
         with:
           tool: cargo-hakari
       - name: Check workspace-hack Cargo.toml is up-to-date
-        uses: actions-rs/cargo@v1
+        uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1
         with:
           command: hakari
           args: generate --diff
       - name: Check all crates depend on workspace-hack
-        uses: actions-rs/cargo@v1
+        uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1
         with:
           command: hakari
           args: manage-deps --dry-run
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 05065093a01..7d299ee725d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,20 +12,20 @@ jobs:
     if: github.repository_owner == 'guppy-rs' && startsWith(github.ref_name, 'target-spec-3')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           persist-credentials: false
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
       - name: Install cargo release
-        uses: baptiste0928/cargo-install@v1
+        uses: baptiste0928/cargo-install@2cfb0024938d23011106cbf127b393bc83fddba1 # v1
         with:
           crate: cargo-release
           # Version 0.21.4 has the idempotency behavior we want, until
           # https://github.com/crate-ci/cargo-release/issues/594 is addressed.
           version: =0.21.4
           locked: true
-      - uses: taiki-e/create-gh-release-action@v1
+      - uses: taiki-e/create-gh-release-action@9762dfdfe60a96b3fef6c4a0aaafd9840f1195b7 # v1
         with:
           prefix: target-spec
           changelog: target-spec/CHANGELOG.md
@@ -41,20 +41,20 @@ jobs:
     if: github.repository_owner == 'guppy-rs' && startsWith(github.ref_name, 'target-spec-miette-')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           persist-credentials: false
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
       - name: Install cargo release
-        uses: baptiste0928/cargo-install@v1
+        uses: baptiste0928/cargo-install@2cfb0024938d23011106cbf127b393bc83fddba1 # v1
         with:
           crate: cargo-release
           # Version 0.21.4 has the idempotency behavior we want, until
           # https://github.com/crate-ci/cargo-release/issues/594 is addressed.
           version: =0.21.4
           locked: true
-      - uses: taiki-e/create-gh-release-action@v1
+      - uses: taiki-e/create-gh-release-action@9762dfdfe60a96b3fef6c4a0aaafd9840f1195b7 # v1
         with:
           prefix: target-spec-miette
           changelog: target-spec-miette/CHANGELOG.md
@@ -70,20 +70,20 @@ jobs:
     if: github.repository_owner == 'guppy-rs' && startsWith(github.ref_name, 'guppy-summaries-')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           persist-credentials: false
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
       - name: Install cargo release
-        uses: baptiste0928/cargo-install@v1
+        uses: baptiste0928/cargo-install@2cfb0024938d23011106cbf127b393bc83fddba1 # v1
         with:
           crate: cargo-release
           # Version 0.21.4 has the idempotency behavior we want, until
           # https://github.com/crate-ci/cargo-release/issues/594 is addressed.
           version: =0.21.4
           locked: true
-      - uses: taiki-e/create-gh-release-action@v1
+      - uses: taiki-e/create-gh-release-action@9762dfdfe60a96b3fef6c4a0aaafd9840f1195b7 # v1
         with:
           prefix: guppy-summaries
           changelog: guppy-summaries/CHANGELOG.md
@@ -100,20 +100,20 @@ jobs:
     if: github.repository_owner == 'guppy-rs' && startsWith(github.ref_name, 'guppy-0')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           persist-credentials: false
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
       - name: Install cargo release
-        uses: baptiste0928/cargo-install@v1
+        uses: baptiste0928/cargo-install@2cfb0024938d23011106cbf127b393bc83fddba1 # v1
         with:
           crate: cargo-release
           # Version 0.21.4 has the idempotency behavior we want, until
           # https://github.com/crate-ci/cargo-release/issues/594 is addressed.
           version: =0.21.4
           locked: true
-      - uses: taiki-e/create-gh-release-action@v1
+      - uses: taiki-e/create-gh-release-action@9762dfdfe60a96b3fef6c4a0aaafd9840f1195b7 # v1
         with:
           prefix: guppy
           changelog: guppy/CHANGELOG.md
@@ -129,20 +129,20 @@ jobs:
     if: github.repository_owner == 'guppy-rs' && startsWith(github.ref_name, 'determinator-')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           persist-credentials: false
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
       - name: Install cargo release
-        uses: baptiste0928/cargo-install@v1
+        uses: baptiste0928/cargo-install@2cfb0024938d23011106cbf127b393bc83fddba1 # v1
         with:
           crate: cargo-release
           # Version 0.21.4 has the idempotency behavior we want, until
           # https://github.com/crate-ci/cargo-release/issues/594 is addressed.
           version: =0.21.4
           locked: true
-      - uses: taiki-e/create-gh-release-action@v1
+      - uses: taiki-e/create-gh-release-action@9762dfdfe60a96b3fef6c4a0aaafd9840f1195b7 # v1
         with:
           prefix: determinator
           changelog: tools/determinator/CHANGELOG.md
@@ -158,20 +158,20 @@ jobs:
     if: github.repository_owner == 'guppy-rs' && startsWith(github.ref_name, 'hakari-')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           persist-credentials: false
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
       - name: Install cargo release
-        uses: baptiste0928/cargo-install@v1
+        uses: baptiste0928/cargo-install@2cfb0024938d23011106cbf127b393bc83fddba1 # v1
         with:
           crate: cargo-release
           # Version 0.21.4 has the idempotency behavior we want, until
           # https://github.com/crate-ci/cargo-release/issues/594 is addressed.
           version: =0.21.4
           locked: true
-      - uses: taiki-e/create-gh-release-action@v1
+      - uses: taiki-e/create-gh-release-action@9762dfdfe60a96b3fef6c4a0aaafd9840f1195b7 # v1
         with:
           prefix: hakari
           changelog: tools/hakari/CHANGELOG.md
@@ -187,12 +187,12 @@ jobs:
     if: github.repository_owner == 'guppy-rs' && startsWith(github.ref_name, 'cargo-hakari-')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           persist-credentials: false
       # Note: do not publish this to crates.io until binaries are built and uploaded below. This is
       # so that `cargo binstall` keeps working.
-      - uses: taiki-e/create-gh-release-action@v1
+      - uses: taiki-e/create-gh-release-action@9762dfdfe60a96b3fef6c4a0aaafd9840f1195b7 # v1
         id: create-gh-release
         with:
           prefix: cargo-hakari
@@ -262,10 +262,10 @@ jobs:
           && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null \
           && sudo apt-get -qq update \
           && sudo apt-get -qq -y install gh
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
-      - uses: taiki-e/upload-rust-binary-action@v1
+      - uses: taiki-e/upload-rust-binary-action@c53aeb3a143a2b61773f7833bae48f4d66e255ce # v1
         with:
           bin: cargo-hakari
           # The tag name contains the binary name so just use that.
@@ -306,11 +306,11 @@ jobs:
       - build-cargo-hakari-binaries
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
       - name: Install cargo release
-        uses: baptiste0928/cargo-install@v1
+        uses: baptiste0928/cargo-install@2cfb0024938d23011106cbf127b393bc83fddba1 # v1
         with:
           crate: cargo-release
           version: =0.21.4