diff --git a/action.yml b/action.yml
index 0e68477..4c64767 100644
--- a/action.yml
+++ b/action.yml
@@ -18,7 +18,7 @@ runs:
   using: composite
   steps:
     - name: Install Flutter
-      uses: subosito/flutter-action@v2
+      uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
       with:
         flutter-version: ${{ inputs.flutter-version }}
         channel: ${{ inputs.channel }}
@@ -26,7 +26,7 @@ runs:
         cache-key: flutter-${{ runner.os }}-${{ hashFiles('pubspec.yaml') }}
 
     - name: Cache pub
-      uses: actions/cache@v6
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         # subosito/flutter-action@v2 exports PUB_CACHE to the job environment,
         # pointing at the directory `flutter pub get` actually populates