diff --git a/.github/workflows/cargo-audit.yml b/.github/workflows/cargo-audit.yml
index d17cc3674230..6749618a3954 100644
--- a/.github/workflows/cargo-audit.yml
+++ b/.github/workflows/cargo-audit.yml
@@ -7,9 +7,9 @@ jobs:
     if: github.repository == 'bytecodealliance/wasmtime'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
         with:
           submodules: true
-      - uses: actions-rs/audit-check@v1
+      - uses: actions-rs/audit-check@35b7b53b1e25b55642157ac01b4adceb5b9ebef3 # v1.2.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 8c16c57201c0..f449cfd20ff0 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -42,7 +42,7 @@ jobs:
     name: Rustfmt
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       with:
         submodules: true
     - uses: ./.github/actions/install-rust
@@ -63,7 +63,7 @@ jobs:
     if: needs.determine.outputs.audit
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       with:
         submodules: true
     - uses: ./.github/actions/install-rust
@@ -87,7 +87,7 @@ jobs:
     if: needs.determine.outputs.audit
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       with:
         submodules: true
     - uses: ./.github/actions/install-rust
@@ -122,7 +122,7 @@ jobs:
       audit: ${{ steps.calculate.outputs.audit }}
       preview1-adapter: ${{ steps.calculate.outputs.preview1-adapter }}
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
     - id: calculate
       env:
         GH_TOKEN: ${{ github.token }}
@@ -186,7 +186,7 @@ jobs:
       RUSTDOCFLAGS: -Dbroken_intra_doc_links --cfg nightlydoc
       OPENVINO_SKIP_LINKING: 1
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       with:
         submodules: true
     - uses: ./.github/actions/install-rust
@@ -199,7 +199,7 @@ jobs:
     - run: cd crates/c-api && doxygen doxygen.conf
 
     # install mdbook, build the docs, and test the docs
-    - uses: actions/cache@v3
+    - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
       with:
         path: ${{ runner.tool_cache }}/mdbook
         key: cargo-mdbook-bin-${{ env.CARGO_MDBOOK_VERSION }}
@@ -231,7 +231,7 @@ jobs:
         mv crates/c-api/html gh-pages/c-api
         mv target/doc gh-pages/api
         tar czf gh-pages.tar.gz gh-pages
-    - uses: actions/upload-artifact@v3
+    - uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3.2.1
       with:
         name: gh-pages
         path: gh-pages.tar.gz
@@ -253,7 +253,7 @@ jobs:
     env:
       CARGO_NDK_VERSION: 2.12.2
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       with:
         submodules: true
     - uses: ./.github/actions/install-rust
@@ -307,8 +307,8 @@ jobs:
     # Check whether `wasmtime` cross-compiles to aarch64-linux-android
     - run: rustup target add aarch64-linux-android
     - name: Setup Android SDK
-      uses: android-actions/setup-android@v2
-    - uses: actions/cache@v3
+      uses: android-actions/setup-android@7c5672355aaa8fde5f97a91aa9a99616d1ace6bc # v2.0.10
+    - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
       with:
         path: ${{ runner.tool_cache }}/cargo-ndk
         key: cargo-ndk-bin-${{ env.CARGO_NDK_VERSION }}
@@ -331,7 +331,7 @@ jobs:
     name: Check Windows ARM64
     runs-on: windows-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       with:
         submodules: true
     - uses: ./.github/actions/install-rust
@@ -351,7 +351,7 @@ jobs:
     name: Fuzz Targets
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       with:
         submodules: true
     # Note that building with fuzzers requires nightly since it uses unstable
@@ -390,7 +390,7 @@ jobs:
       fail-fast: true
       matrix: ${{ fromJson(needs.determine.outputs.test-matrix) }}
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       with:
         submodules: true
     - uses: ./.github/actions/install-rust
@@ -408,7 +408,7 @@ jobs:
 
     - run: cargo fetch --locked
 
-    - uses: actions/cache@v3
+    - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
       with:
         path: ${{ runner.tool_cache }}/qemu
         key: qemu-${{ matrix.target }}-${{ env.QEMU_BUILD_VERSION }}-patchcpuinfo
@@ -496,12 +496,12 @@ jobs:
     name: Test wasi-nn module
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
         with:
           submodules: true
       - uses: ./.github/actions/install-rust
       - run: rustup target add wasm32-wasi
-      - uses: abrown/install-openvino-action@v7
+      - uses: abrown/install-openvino-action@fe7412dddbed9fbd2243731a8d49f1bc55c2ba20 # v7
         with:
           version: 2022.3.0
           apt: true
@@ -524,7 +524,7 @@ jobs:
       deployments: write
       contents: write
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       with:
         submodules: true
     - run: rustup update stable && rustup default stable
@@ -539,7 +539,7 @@ jobs:
       env:
         VERSION: ${{ github.sha }}
 
-    - uses: actions/upload-artifact@v3
+    - uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3.2.1
       with:
         name: bins-wasi-preview1-component-adapter
         path: target/wasm32-unknown-unknown/release/wasi_snapshot_preview1.*.wasm
@@ -558,7 +558,7 @@ jobs:
     name: Run benchmarks
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       with:
         submodules: true
     - uses: ./.github/actions/install-rust
@@ -578,7 +578,7 @@ jobs:
     name: Meta deterministic check
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       with:
         submodules: true
     - uses: ./.github/actions/install-rust
@@ -596,7 +596,7 @@ jobs:
     if: github.repository == 'bytecodealliance/wasmtime' && needs.determine.outputs.run-full
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       with:
         submodules: true
     - run: rustup update stable && rustup default stable
@@ -634,14 +634,14 @@ jobs:
     env:
       CARGO_NEXTEST_VERSION: 0.9.51
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       with:
         submodules: true
     - uses: ./.github/actions/install-rust
       with:
         toolchain: nightly-2023-10-10
     - run: rustup component add rust-src miri
-    - uses: actions/cache@v3
+    - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
       with:
         path: ${{ runner.tool_cache }}/cargo-nextest
         key: cargo-nextest-bin-${{ env.CARGO_NEXTEST_VERSION }}
@@ -676,7 +676,7 @@ jobs:
       fail-fast: false
       matrix: ${{ fromJson(needs.determine.outputs.build-matrix) }}
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       with:
         submodules: true
 
@@ -701,7 +701,7 @@ jobs:
     # unconditionally to this workflow's files so we have a copy of them.
     - run: ./ci/build-tarballs.sh "${{ matrix.build }}" "${{ matrix.target }}"
 
-    - uses: actions/upload-artifact@v3
+    - uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3.2.1
       with:
         name: bins-${{ matrix.build }}
         path: dist
@@ -791,7 +791,7 @@ jobs:
       && startsWith(github.ref, 'refs/heads/release-')
       && github.repository == 'bytecodealliance/wasmtime'
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       with:
         submodules: true
         fetch-depth: 0
diff --git a/.github/workflows/performance.yml b/.github/workflows/performance.yml
index 0b39524a70f6..c70074475bff 100644
--- a/.github/workflows/performance.yml
+++ b/.github/workflows/performance.yml
@@ -74,7 +74,7 @@ jobs:
           cargo build --release
 
       - name: Checkout patch from bytecodealliance/wasmtime (pushed and triggering on this perf repo)
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
         with:
           submodules: true
           path: wasmtime_commit
@@ -89,7 +89,7 @@ jobs:
           cp target/release/libwasmtime_bench_api.so /tmp/wasmtime_commit.so
 
       - name: Checkout main from bytecodealliance/wasmtime
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
         with:
           ref: 'main'
           repository: 'bytecodealliance/wasmtime'
diff --git a/.github/workflows/publish-artifacts.yml b/.github/workflows/publish-artifacts.yml
index 8c149003dc91..f5484d8c78f7 100644
--- a/.github/workflows/publish-artifacts.yml
+++ b/.github/workflows/publish-artifacts.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'bytecodealliance/wasmtime'
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
     - run: |
         sha=${{ github.sha }}
         run_id=$(
@@ -34,7 +34,7 @@ jobs:
     - run: tar xf gh-pages.tar.gz
       working-directory: gh-pages
     - name: Deploy to gh-pages
-      uses: JamesIves/github-pages-deploy-action@v4
+      uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f # v4.8.0
       with:
         folder: ./gh-pages/gh-pages
         single-commit: true
diff --git a/.github/workflows/publish-to-cratesio.yml b/.github/workflows/publish-to-cratesio.yml
index 6d05b66778a4..fc8b613d6a4f 100644
--- a/.github/workflows/publish-to-cratesio.yml
+++ b/.github/workflows/publish-to-cratesio.yml
@@ -14,7 +14,7 @@ jobs:
     if: github.repository == 'bytecodealliance/wasmtime'
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       with:
         submodules: true
     - run: rustup update stable && rustup default stable
diff --git a/.github/workflows/release-process.yml b/.github/workflows/release-process.yml
index e2003a456d92..e09d0b56c797 100644
--- a/.github/workflows/release-process.yml
+++ b/.github/workflows/release-process.yml
@@ -38,7 +38,7 @@ jobs:
     name: Run the release process
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
         with:
           submodules: true
       - name: Setup
diff --git a/.github/workflows/triage.yml b/.github/workflows/triage.yml
index c7bde9931c42..66ee02ed4c5b 100644
--- a/.github/workflows/triage.yml
+++ b/.github/workflows/triage.yml
@@ -22,17 +22,17 @@ jobs:
 
     # Automatically label PRs that touch certain directories with certain
     # labels.
-    - uses: bytecodealliance/labeler@schedule-fork
+    - uses: bytecodealliance/labeler@f6157f32fa13c4d01e14d3df38d4b6e17e36eb5f # schedule-fork
       with:
         repo-token: "${{ secrets.GITHUB_TOKEN }}"
 
     # @-mention people who are subscribed to a label when an issue/PR is given
     # that label.
-    - uses: bytecodealliance/subscribe-to-label-action@v1
+    - uses: bytecodealliance/subscribe-to-label-action@f669a502948c4667f8db07a79e9c5c87b7852e0b # v1
       with:
         repo-token: "${{ secrets.GITHUB_TOKEN }}"
 
     # Leave pre-determined comments on issues/PRs that are given a certain label.
-    - uses: bytecodealliance/label-messager-action@v1
+    - uses: bytecodealliance/label-messager-action@2f83571c7af396405ff3bad7777b187b9dd60f88 # v1
       with:
         repo-token: "${{ secrets.GITHUB_TOKEN }}"