diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 8b850da..805e8a5 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -27,7 +27,7 @@ jobs:
           fetch-depth: 0
 
       - name: Open Backport PR
-        uses: zeebe-io/backport-action@v0.0.4
+        uses: zeebe-io/backport-action@2ee900dc92632adf994f8e437b6d16840fd61f58 # v0.0.9
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           github_workspace: ${{ github.workspace }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1d2724a..852d4f2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,7 +29,7 @@ jobs:
     steps:
       - name: Detect No-op Changes
         id: noop
-        uses: fkirc/skip-duplicate-actions@v2.1.0
+        uses: fkirc/skip-duplicate-actions@0c0fd7dfd27f1de7871e98791077b9ae5f1d8757 # v2.2.0
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           paths_ignore: '["**.md", "**.png", "**.jpg"]'
diff --git a/.github/workflows/commands.yml b/.github/workflows/commands.yml
index 815838b..3f69d2b 100644
--- a/.github/workflows/commands.yml
+++ b/.github/workflows/commands.yml
@@ -85,7 +85,7 @@ jobs:
         fetch-depth: 0
 
     - name: Open Backport PR
-      uses: zeebe-io/backport-action@v0.0.4
+      uses: zeebe-io/backport-action@2ee900dc92632adf994f8e437b6d16840fd61f58 # v0.0.9
       with:
         github_token: ${{ secrets.GITHUB_TOKEN }}
         github_workspace: ${{ github.workspace }}
diff --git a/.github/workflows/pushvalidation.yml b/.github/workflows/pushvalidation.yml
index 081e9f2..49869d8 100644
--- a/.github/workflows/pushvalidation.yml
+++ b/.github/workflows/pushvalidation.yml
@@ -23,7 +23,7 @@ jobs:
     steps:
       - name: Detect No-op Changes
         id: noop
-        uses: fkirc/skip-duplicate-actions@v2.1.0
+        uses: fkirc/skip-duplicate-actions@0c0fd7dfd27f1de7871e98791077b9ae5f1d8757 # v2.2.0
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           paths_ignore: '["**.md", "**.png", "**.jpg"]'