diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 6e5a0886..2c844337 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -25,7 +25,7 @@ jobs:
     steps:
     -
       name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v3.0.2
     # Initializes the CodeQL tools for scanning.
     -
       name: Initialize CodeQL
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index cd3c6ff6..9e622f4a 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -13,7 +13,7 @@ jobs:
       issues: write
 
     steps:
-      - uses: actions/stale@v5
+      - uses: actions/stale@v5.1.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           days-before-stale: 30
diff --git a/.github/workflows/sync-back-to-dev.yml b/.github/workflows/sync-back-to-dev.yml
index f79b69f2..27d966d2 100644
--- a/.github/workflows/sync-back-to-dev.yml
+++ b/.github/workflows/sync-back-to-dev.yml
@@ -11,7 +11,7 @@ jobs:
     name: Syncing branches
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v3.0.2
       - name: Opening pull request
         id: pull
         uses: tretuna/sync-branches@1.4.0
@@ -20,7 +20,7 @@ jobs:
           FROM_BRANCH: 'master'
           TO_BRANCH: 'development'
       - name: Label the pull request to ignore for release note generation
-        uses: actions-ecosystem/action-add-labels@v1
+        uses: actions-ecosystem/action-add-labels@v1.1.0
         with:
           labels: internal
           repo: ${{ github.repository }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 8d496bba..177a24ba 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -14,7 +14,7 @@ jobs:
     steps:
     -
       name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v3.0.2
     -
       name: Check scripts in repository are executable
       run: |
@@ -30,7 +30,7 @@ jobs:
         ignore_words_file: .codespellignore
     -
       name: Get editorconfig-checker
-      uses: editorconfig-checker/action-editorconfig-checker@main
+      uses: editorconfig-checker/action-editorconfig-checker@main # tag v1.0.0 is really out of date
     -
       name: Run editorconfig-checker
       run: editorconfig-checker
@@ -49,10 +49,10 @@ jobs:
     steps:
     -
       name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v3.0.2
     -
       name: Set up Python 3.8
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v4.1.0
       with:
         python-version: 3.8
     -