diff --git a/.forgejo/workflows/release.yaml b/.forgejo/workflows/release.yaml
index 40ff43d..cf42e94 100644
--- a/.forgejo/workflows/release.yaml
+++ b/.forgejo/workflows/release.yaml
@@ -21,7 +21,7 @@ jobs:
           secretid: ${{ secrets.VAULT_SECRET_ID }}
 
       - name: "Determine next version"
-        uses: https://github.com/obfu5c8/action-svu@v1
+        uses: https://github.com/obfu5c8/action-svu@e0ac511a90318bc284bf845936acd5c5c077d788 # v1
         id: generate_next_version
         with:
           type: auto
@@ -42,7 +42,7 @@ jobs:
           mvn -B --file pom.xml versions:set -DnewVersion=$NEW_VERSION
 
       - name: "Run JReleaser (Changelog)"
-        uses: https://github.com/jreleaser/release-action@2.4.2
+        uses: https://github.com/jreleaser/release-action@f69e545b05f149483cecb2fb81866247992694b8 # 2.4.2
         with:
           arguments: changelog --debug
           setup-java: false
@@ -63,28 +63,28 @@ jobs:
           mvn -X --file pom.xml -Ppublication
 
       - name: "Run JReleaser (Assemble)"
-        uses: https://github.com/jreleaser/release-action@2.4.2
+        uses: https://github.com/jreleaser/release-action@f69e545b05f149483cecb2fb81866247992694b8 # 2.4.2
         with:
           arguments: assemble --debug
           setup-java: false
         continue-on-error: true
 
       - name: "Run JReleaser (Release)"
-        uses: https://github.com/jreleaser/release-action@2.4.2
+        uses: https://github.com/jreleaser/release-action@f69e545b05f149483cecb2fb81866247992694b8 # 2.4.2
         with:
           arguments: release --debug
           setup-java: false
 
       - name: JReleaser release trace
         if: always()
-        uses: https://gitea.com/actions/upload-artifact@v3
+        uses: https://gitea.com/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3
         with:
           name: jreleaser-trace
           path: target/jreleaser/trace.log
 
       - name: JReleaser release properties
         if: always()
-        uses: https://gitea.com/actions/upload-artifact@v3
+        uses: https://gitea.com/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3
         with:
           name: jreleaser-properties
           path: target/jreleaser/output.properties
diff --git a/.forgejo/workflows/sonarqube.yaml b/.forgejo/workflows/sonarqube.yaml
index 8659467..be075e5 100644
--- a/.forgejo/workflows/sonarqube.yaml
+++ b/.forgejo/workflows/sonarqube.yaml
@@ -20,7 +20,7 @@ jobs:
           secretid: "${{ secrets.VAULT_SECRET_ID }}"
 
       - name: "Cache SonarQube packages"
-        uses: https://github.com/actions/cache@v4
+        uses: https://github.com/actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
         with:
           path: ~/.sonar/cache
           key: "${{ runner.os }}-sonar"