diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 2fcbe6e..73c658b 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -66,7 +66,7 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@f3712979fa5f215279b101dd0a2e3bdfb4353324 # v3
         with:
           # `actions` matters at least as much as `python` here: the runtime
           # is stdlib-only, while the CI is where a public repo is actually
@@ -88,9 +88,9 @@ jobs:
         # file-at-a-time scan would not connect. Skipped for `actions`, which
         # analyses YAML and has nothing to build.
         if: matrix.language == 'python'
-        uses: github/codeql-action/autobuild@v3
+        uses: github/codeql-action/autobuild@f3712979fa5f215279b101dd0a2e3bdfb4353324 # v3
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@f3712979fa5f215279b101dd0a2e3bdfb4353324 # v3
         with:
           category: "/language:${{ matrix.language }}"