diff --git a/.github/workflows/tfjs-ci.yml b/.github/workflows/tfjs-ci.yml
index 435b9313755..5ffa17dd939 100644
--- a/.github/workflows/tfjs-ci.yml
+++ b/.github/workflows/tfjs-ci.yml
@@ -14,7 +14,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: bazel-contrib/setup-bazel@0.14.0
+      - uses: bazel-contrib/setup-bazel@e8776f58fb6a6e9055cbaf1b38c52ccc5247e9c4 # 0.14.0
         with:
           # Avoid downloading Bazel every time.
           bazelisk-cache: true
@@ -22,9 +22,9 @@ jobs:
           disk-cache: ${{ github.workflow }}-cpu
           # Share repository cache between workflows.
           repository-cache: true
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Test TFJS CPU
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 20.x
           cache: 'npm'
@@ -35,7 +35,7 @@ jobs:
   test-gpu-mac:
     runs-on: macos-latest-xlarge # consumer gpu
     steps:
-      - uses: bazel-contrib/setup-bazel@0.14.0
+      - uses: bazel-contrib/setup-bazel@e8776f58fb6a6e9055cbaf1b38c52ccc5247e9c4 # 0.14.0
         with:
           # Avoid downloading Bazel every time.
           bazelisk-cache: true
@@ -43,9 +43,9 @@ jobs:
           disk-cache: ${{ github.workflow }}-gpu-mac
           # Share repository cache between workflows.
           repository-cache: true
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Test TFJS GPU
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 20.x
           cache: 'npm'
diff --git a/.github/workflows/tfjs-nightly-release-and-publish-test.yml b/.github/workflows/tfjs-nightly-release-and-publish-test.yml
index aae8c18e7db..86fc3ba7f11 100644
--- a/.github/workflows/tfjs-nightly-release-and-publish-test.yml
+++ b/.github/workflows/tfjs-nightly-release-and-publish-test.yml
@@ -13,17 +13,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.14.0
+        uses: bazel-contrib/setup-bazel@e8776f58fb6a6e9055cbaf1b38c52ccc5247e9c4 # 0.14.0
         with:
           bazelisk-cache: true
           disk-cache: ${{ github.workflow }}-nightly-release
           repository-cache: true
 
       - name: Setup Node.js and Yarn
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 20.x # Using a current LTS version of Node.js
           cache: 'yarn'
diff --git a/.github/workflows/tfjs-release-branch-publish-test.yml b/.github/workflows/tfjs-release-branch-publish-test.yml
index df51fa4acca..dfc74a763b4 100644
--- a/.github/workflows/tfjs-release-branch-publish-test.yml
+++ b/.github/workflows/tfjs-release-branch-publish-test.yml
@@ -14,17 +14,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.14.0
+        uses: bazel-contrib/setup-bazel@e8776f58fb6a6e9055cbaf1b38c52ccc5247e9c4 # 0.14.0
         with:
           bazelisk-cache: true
           disk-cache: ${{ github.workflow }}-release-e2e
           repository-cache: true
 
       - name: Setup Node.js and Yarn
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 20.x
           cache: 'yarn' # Changed from 'npm' in example to 'yarn' as primary tool here