diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3c0b50d..e602aad 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,7 +22,7 @@ jobs:
 
       - uses: astral-sh/setup-uv@v6
 
-      - uses: actions/setup-python@v5
+      - uses: chainguard-actions/actions-setup-python@ace3254bb5011efbd0650a7120a0441ebd1f9400 # v5.6.0
         with:
           python-version: ${{ matrix.python-version }}
           allow-prereleases: true
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 4cdf003..f58c45e 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -30,9 +30,9 @@ jobs:
       - name: Generate docs
         run: uv run poe generate-docs
 
-      - uses: actions/upload-pages-artifact@v3
+      - uses: chainguard-actions/actions-upload-pages-artifact@e2c4c7670c215010f2d293cce333c0ec3e87f47a # v3.0.1
         with:
           path: _site
 
       - id: deployment
-        uses: actions/deploy-pages@v4
+        uses: chainguard-actions/actions-deploy-pages@f4d5c29b63bb3df1e6eac647993dd0c3fe33651c # v4.0.5
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 089114a..e2b8ed2 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -17,4 +17,4 @@ jobs:
 
       - run: uv build
 
-      - uses: pypa/gh-action-pypi-publish@release/v1
+      - uses: chainguard-actions/pypa-gh-action-pypi-publish@3281eae6a06d4b96e24616f7821380f05fa50296 # v1.14.3