diff --git a/.github/workflows/apply-repo-settings.yaml b/.github/workflows/apply-repo-settings.yaml
index 0cbbd98..781ae59 100644
--- a/.github/workflows/apply-repo-settings.yaml
+++ b/.github/workflows/apply-repo-settings.yaml
@@ -50,14 +50,14 @@ jobs:
     steps:
       - name: Checkout as GitHub App
         id: checkout
-        uses: nsheaps/github-actions/.github/actions/checkout-as-app@main
+        uses: nsheaps/github-actions/.github/actions/checkout-as-app@c1794f6f4fbb3cbc5e5a71e820581a74239f706a # main
         with:
           app-id: ${{ secrets.AUTOMATION_GITHUB_APP_ID }}
           private-key: ${{ secrets.AUTOMATION_GITHUB_APP_PRIVATE_KEY }}
 
       - name: Apply
         id: apply
-        uses: nsheaps/github-actions/.github/actions/apply-repo-settings@main
+        uses: nsheaps/github-actions/.github/actions/apply-repo-settings@c1794f6f4fbb3cbc5e5a71e820581a74239f706a # main
         with:
           token: ${{ steps.checkout.outputs.token }}
           dry-run: ${{ inputs.dry-run || false }}
diff --git a/.github/workflows/dispatch-review.yaml b/.github/workflows/dispatch-review.yaml
index 7206c0c..8ea738c 100644
--- a/.github/workflows/dispatch-review.yaml
+++ b/.github/workflows/dispatch-review.yaml
@@ -53,7 +53,7 @@ jobs:
     # on the next PR event in repos using this template. This is intentional —
     # operators who need pinned stability should replace @main with a commit SHA
     # and update it in lock-step with plugin version bumps.
-    uses: nsheaps/agents/.github/workflows/review-dispatch.yaml@main
+    uses: nsheaps/agents/.github/workflows/review-dispatch.yaml@625b33b3d106b9cf574527aef6edccdf6e7af4f0 # main
     # secrets: inherit doesn't pass cross-repo (GitHub limitation).
     secrets:
       AUTOMATION_GITHUB_APP_ID: ${{ secrets.AUTOMATION_GITHUB_APP_ID }}
diff --git a/.github/workflows/pr-status-dispatch.yaml b/.github/workflows/pr-status-dispatch.yaml
index 5d7037d..2a6dc34 100644
--- a/.github/workflows/pr-status-dispatch.yaml
+++ b/.github/workflows/pr-status-dispatch.yaml
@@ -41,7 +41,7 @@ jobs:
     steps:
       - name: Authenticate as GitHub App
         id: app-token
-        uses: nsheaps/github-actions/.github/actions/github-app-auth@main
+        uses: nsheaps/github-actions/.github/actions/github-app-auth@c1794f6f4fbb3cbc5e5a71e820581a74239f706a # main
         with:
           app-id: ${{ secrets.AUTOMATION_GITHUB_APP_ID }}
           private-key: ${{ secrets.AUTOMATION_GITHUB_APP_PRIVATE_KEY }}