diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d8632acb1..c2a599367 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -400,7 +400,7 @@ jobs:
       # Windows and macOS runners bill at a multiple of Linux, so the dependency
       # compile is cached rather than paid on every PR.
       - name: Rust cache
-        uses: swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+        uses: swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           workspaces: standalone/src-tauri
 
diff --git a/.github/workflows/hosted-preview.yml b/.github/workflows/hosted-preview.yml
index cdab49f47..83fdaded3 100644
--- a/.github/workflows/hosted-preview.yml
+++ b/.github/workflows/hosted-preview.yml
@@ -122,7 +122,7 @@ jobs:
           PREVIEW_AUTH_SECRET: ${{ secrets.PREVIEW_AUTH_SECRET }}
       - name: Create or reuse PR database branch
         id: database
-        uses: neondatabase/create-branch-action@fb620d43d4c565abaf088b848a4e28e5c4ea4d9c # v6
+        uses: neondatabase/create-branch-action@fb620d43d4c565abaf088b848a4e28e5c4ea4d9c # 6.3.1
         with:
           project_id: ${{ vars.NEON_PROJECT_ID }}
           parent_branch: ${{ vars.NEON_PREVIEW_PARENT_BRANCH }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 788ceaec1..4fa75dacf 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -89,7 +89,7 @@ jobs:
           echo "TAURI_SIGNING_PRIVATE_KEY=$key_path" >> "$GITHUB_ENV"
 
       - name: Build Tauri app
-        uses: tauri-apps/tauri-action@1deb371b0cd8bd54025b384f1cd735e725c4060f # v1
+        uses: tauri-apps/tauri-action@1deb371b0cd8bd54025b384f1cd735e725c4060f # v1.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with: