diff --git a/.gitea/workflows/build-nightlly.yml b/.gitea/workflows/build-nightlly.yml
index 3c22f0b..0df9389 100644
--- a/.gitea/workflows/build-nightlly.yml
+++ b/.gitea/workflows/build-nightlly.yml
@@ -12,7 +12,7 @@ jobs:
     name: Build AppImage
     runs-on: ubuntu-22.04
     steps:
-      - uses: https://gitea.com/actions/checkout@v4
+      - uses: https://gitea.com/actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
 
       - name: Install required dependencies
         run: |
@@ -63,7 +63,7 @@ jobs:
           echo '%_topdir /home/rpmbuild' > /home/rpmbuild/.rpmmacros
 
       - name: Checkout repo
-        uses: https://gitea.com/actions/checkout@v4
+        uses: https://gitea.com/actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
 
       - name: Copy fedora.spec
         run: |
@@ -84,7 +84,7 @@ jobs:
     name: Build Arch Package
     runs-on: ubuntu-22.04
     container:
-      image: archlinux:base-devel
+      image: archlinux:base-devel@sha256:8ccc930c28ab4f483ff9bc1b53957150fbe94afe48928ebb0b14a8af41c75023
       volumes:
         - /usr:/usr-host
         - /opt:/opt-host
@@ -124,7 +124,7 @@ jobs:
           su user -c "yes '' | makepkg --noconfirm -s -p PKGBUILD-git"
 
       - name: Checkout
-        uses: https://gitea.com/actions/checkout@v4
+        uses: https://gitea.com/actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
 
       - name: Upload Arch package
         uses: https://gitea.com/actions/gitea-upload-artifact@v4
diff --git a/.gitea/workflows/check-spell.yml b/.gitea/workflows/check-spell.yml
index 9f5e610..7c6b52e 100644
--- a/.gitea/workflows/check-spell.yml
+++ b/.gitea/workflows/check-spell.yml
@@ -15,10 +15,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: https://gitea.com/actions/checkout@v4
+        uses: https://gitea.com/actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
 
       - name: Set up Python
-        uses: https://gitea.com/actions/setup-python@v5
+        uses: https://gitea.com/actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version-file: "pyproject.toml"
 
diff --git a/.gitea/workflows/code-build.yml b/.gitea/workflows/code-build.yml
index ebf6900..236f5c4 100644
--- a/.gitea/workflows/code-build.yml
+++ b/.gitea/workflows/code-build.yml
@@ -18,7 +18,7 @@ jobs:
       fedora:   ${{ steps.check.outputs.fedora }}
       arch:     ${{ steps.check.outputs.arch }}
     steps:
-      - uses: https://gitea.com/actions/checkout@v4
+      - uses: https://gitea.com/actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
         with:
           fetch-depth: 0
 
@@ -63,7 +63,7 @@ jobs:
     needs: changes
     if: needs.changes.outputs.appimage == 'true' || github.event_name == 'workflow_dispatch'
     steps:
-      - uses: https://gitea.com/actions/checkout@v4
+      - uses: https://gitea.com/actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
 
       - name: Install required dependencies
         run: |
@@ -115,7 +115,7 @@ jobs:
           echo '%_topdir /home/rpmbuild' > /home/rpmbuild/.rpmmacros
 
       - name: Checkout repo
-        uses: https://gitea.com/actions/checkout@v4
+        uses: https://gitea.com/actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
 
       - name: Copy fedora-git.spec
         run: |
@@ -138,7 +138,7 @@ jobs:
     needs: changes
     if: needs.changes.outputs.arch == 'true' || github.event_name == 'workflow_dispatch'
     container:
-      image: archlinux:base-devel
+      image: archlinux:base-devel@sha256:8ccc930c28ab4f483ff9bc1b53957150fbe94afe48928ebb0b14a8af41c75023
       volumes:
         - /usr:/usr-host
         - /opt:/opt-host
@@ -178,7 +178,7 @@ jobs:
           su user -c "yes '' | makepkg --noconfirm -s -p PKGBUILD-git"
 
       - name: Checkout
-        uses: https://gitea.com/actions/checkout@v4
+        uses: https://gitea.com/actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
 
       - name: Upload Arch package
         uses: https://gitea.com/actions/gitea-upload-artifact@v4
diff --git a/.gitea/workflows/code-check.yml b/.gitea/workflows/code-check.yml
index 20b99ad..79f6062 100644
--- a/.gitea/workflows/code-check.yml
+++ b/.gitea/workflows/code-check.yml
@@ -20,10 +20,10 @@ jobs:
     name: Check code
     runs-on: ubuntu-latest
     steps:
-      - uses: https://gitea.com/actions/checkout@v4
+      - uses: https://gitea.com/actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
 
       - name: Set up Node.js
-        uses: https://gitea.com/actions/setup-node@v4
+        uses: https://gitea.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 20
 
diff --git a/.gitea/workflows/generate-appid.yml b/.gitea/workflows/generate-appid.yml
index 0ad8b1c..54d979e 100644
--- a/.gitea/workflows/generate-appid.yml
+++ b/.gitea/workflows/generate-appid.yml
@@ -11,10 +11,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: https://gitea.com/actions/checkout@v4
+        uses: https://gitea.com/actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
 
       - name: Set up Python
-        uses: https://gitea.com/actions/setup-python@v5
+        uses: https://gitea.com/actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version-file: "pyproject.toml"
 
diff --git a/.gitea/workflows/renovate.yml b/.gitea/workflows/renovate.yml
index 40b5579..3718251 100644
--- a/.gitea/workflows/renovate.yml
+++ b/.gitea/workflows/renovate.yml
@@ -8,12 +8,12 @@ on:
 jobs:
   renovate:
     runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:latest
+    container: ghcr.io/renovatebot/renovate:latest@sha256:46b57bb9816dec6409e7be57e0e5f7b26d214281044f5aedd3b160be178475e2
     steps:
-      - uses: https://gitea.com/actions/checkout@v4
+      - uses: https://gitea.com/actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
 
       - name: Set up Node.js
-        uses: https://gitea.com/actions/setup-node@v4
+        uses: https://gitea.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 20