diff --git a/.github/workflows/closed-issue-message.yml b/.github/workflows/closed-issue-message.yml
index 3340afb1f3..000b89ffe6 100644
--- a/.github/workflows/closed-issue-message.yml
+++ b/.github/workflows/closed-issue-message.yml
@@ -2,11 +2,17 @@ name: Closed Issue Message
 on:
     issues:
        types: [closed]
+
+permissions:
+  contents: read
+
 jobs:
     auto_comment:
         runs-on: ubuntu-latest
+        permissions:
+            issues: write
         steps:
-        - uses: aws-actions/closed-issue-message@v1
+        - uses: aws-actions/closed-issue-message@8b6324312193476beecf11f8e8539d73a3553bf4
           with:
             # These inputs are both required
             repo-token: "${{ secrets.GITHUB_TOKEN }}"
diff --git a/.github/workflows/handle-stale-discussions.yml b/.github/workflows/handle-stale-discussions.yml
index f89938e11b..e121d39c50 100644
--- a/.github/workflows/handle-stale-discussions.yml
+++ b/.github/workflows/handle-stale-discussions.yml
@@ -5,6 +5,9 @@ on:
   discussion_comment:
     types: [created]
 
+permissions:
+  contents: read
+
 jobs:
   handle-stale-discussions:
     name: Handle stale discussions
@@ -13,7 +16,7 @@ jobs:
       discussions: write
     steps:
       - name: Stale discussions action
-        uses: aws-github-ops/handle-stale-discussions@v1
+        uses: aws-github-ops/handle-stale-discussions@a98e47e10f9a5d4ed08ffb27b7a19454302f9a43
         with:
           # This will close stale-discussions as outdated instead of answered
           close-stale-as-answered: false
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 39bb3e9eea..a20cc198fc 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -13,10 +13,10 @@ jobs:
     runs-on: ubuntu-20.04
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
     - name: Set up Python 3.9
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1
       with:
         python-version: 3.9
     - name: Run pre-commit
-      uses: pre-commit/action@v3.0.0
+      uses: pre-commit/action@646c83fcd040023954eafda54b4db0192ce70507
diff --git a/.github/workflows/run-tests.yml b/.github/workflows/run-tests.yml
index 0d54078101..c0bf1d9bd1 100644
--- a/.github/workflows/run-tests.yml
+++ b/.github/workflows/run-tests.yml
@@ -19,9 +19,9 @@ jobs:
         os: [ubuntu-latest, macOS-latest, windows-latest]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1
       with:
         python-version: ${{ matrix.python-version }}
     - name: Install dependencies
diff --git a/.github/workflows/stale_issue.yml b/.github/workflows/stale_issue.yml
index c2d5bbdfb6..e7852ecc68 100644
--- a/.github/workflows/stale_issue.yml
+++ b/.github/workflows/stale_issue.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Stale issue job
     steps:
-    - uses: aws-actions/stale-issue-cleanup@v6
+    - uses: aws-actions/stale-issue-cleanup@f290bcce1d77c9abc0357b7faed3c1c7c2f7d78f
       with:
         issue-types: issues
         stale-issue-message: Greetings! It looks like this issue hasn’t been