diff --git a/.github/workflows/composer.yml b/.github/workflows/composer.yml
index e5215df..cd54fc5 100644
--- a/.github/workflows/composer.yml
+++ b/.github/workflows/composer.yml
@@ -21,9 +21,9 @@ jobs:
         php-versions: ['8.2', '8.3']
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
-    - uses: shivammathur/setup-php@v2
+    - uses: shivammathur/setup-php@9e72090525849c5e82e596468b86eb55e9cc5401 # v2
       with:
         php-version: ${{ matrix.php-versions }}
 
@@ -32,7 +32,7 @@ jobs:
 
     - name: Cache Composer packages
       id: composer-cache
-      uses: actions/cache@v4
+      uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
       with:
         path: vendor
         key: ${{ runner.os }}-php-${{ matrix.php-versions }}-${{ hashFiles('**/composer.lock') }}