diff --git a/.github/workflows/ci-codeql.yml b/.github/workflows/ci-codeql.yml
index ebdda1f..e61d417 100644
--- a/.github/workflows/ci-codeql.yml
+++ b/.github/workflows/ci-codeql.yml
@@ -27,7 +27,7 @@ jobs:
         include:
           - language: actions
             build-mode: none
-    uses: touchtheduck/.github/.github/workflows/reusable-codeql.yml@main
+    uses: touchtheduck/.github/.github/workflows/reusable-codeql.yml@da18a888441b4a4e23271c7b10f5c09b069d89aa # main
     with:
       language: ${{ matrix.language }}
       build-mode: ${{ matrix.build-mode }}
\ No newline at end of file
diff --git a/.github/workflows/ci-ossf-scorecard.yml b/.github/workflows/ci-ossf-scorecard.yml
index a68d191..96523cb 100644
--- a/.github/workflows/ci-ossf-scorecard.yml
+++ b/.github/workflows/ci-ossf-scorecard.yml
@@ -12,7 +12,7 @@ permissions:
 jobs:
   analysis:
     name: Scorecard analysis
-    uses: touchtheduck/.github/.github/workflows/reusable-ossf-scorecard.yml@main
+    uses: touchtheduck/.github/.github/workflows/reusable-ossf-scorecard.yml@da18a888441b4a4e23271c7b10f5c09b069d89aa # main
     permissions:
       contents: read
       security-events: write