diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 3028556..84d80b4 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -44,16 +44,16 @@ jobs:
       # Full history and tags: hatch-vcs derives the version from git state, so a
       # shallow clone would build the wrong number rather than fail.
       - name: Check out source repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 0
           fetch-tags: true
           ref: ${{ inputs.ref || github.ref }}
       - name: Set up Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@v7.0.0
         with:
-          python-version: "3.13"
+          python-version: "3.13.15"
       - name: Install dependencies
         # renovate: datasource=pypi depName=hatch
         run: pip install hatch==1.18.0
@@ -86,7 +86,7 @@ jobs:
       # Upload artifacts for later use
       - name: Upload Artifacts
         if: matrix.reqstool-source == 'pypi'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: ${{ inputs.artifact-name || 'dist' }}
           path: dist/
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 0825e9c..62355c5 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -8,11 +8,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out source repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
       - name: Set up Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@v7.0.0
         with:
-          python-version: "3.13"
+          python-version: "3.13.15"
       - name: Install pip package(s)
         # renovate: datasource=pypi depName=hatch
         run: pip install hatch==1.18.0