diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index ade7e7d..359a5a0 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -12,7 +12,7 @@ on:
           - prod
 jobs:
   run:
-    uses: lehigh-university-libraries/gha/.github/workflows/linderman-deploy.yaml@main
+    uses: lehigh-university-libraries/gha/.github/workflows/linderman-deploy.yaml@e26d86abfbe300be4d93570b666651c11471995b # main
     with:
       url: https://apps-${{ inputs.environment }}.lib.lehigh.edu/_rollout
     permissions:
diff --git a/.github/workflows/github-release.yml b/.github/workflows/github-release.yml
index 0b3651d..3fcef70 100644
--- a/.github/workflows/github-release.yml
+++ b/.github/workflows/github-release.yml
@@ -8,7 +8,7 @@ on:
 jobs:
   release:
     if: github.event.pull_request.merged == true && !contains(github.event.pull_request.title, 'skip-release')
-    uses: lehigh-university-libraries/gha/.github/workflows/bump-release.yaml@main
+    uses: lehigh-university-libraries/gha/.github/workflows/bump-release.yaml@e26d86abfbe300be4d93570b666651c11471995b # main
     permissions:
       contents: write
     secrets: inherit
diff --git a/.github/workflows/lint-test-build-deploy.yml b/.github/workflows/lint-test-build-deploy.yml
index 1f804ce..fb6aad4 100644
--- a/.github/workflows/lint-test-build-deploy.yml
+++ b/.github/workflows/lint-test-build-deploy.yml
@@ -25,13 +25,13 @@ jobs:
         with:
           verbose: true
 
-      - uses: psf/black@stable
+      - uses: psf/black@87928e6d6761a4a6d22250e1fee5601b3998086e # stable
         with:
           options: "--check --verbose"
 
   build-push:
     needs: [lint]
-    uses: lehigh-university-libraries/gha/.github/workflows/build-push-ghcr.yaml@main
+    uses: lehigh-university-libraries/gha/.github/workflows/build-push-ghcr.yaml@e26d86abfbe300be4d93570b666651c11471995b # main
     permissions:
       contents: read
       packages: write
@@ -39,7 +39,7 @@ jobs:
 
   deploy:
     needs: [build-push]
-    uses: lehigh-university-libraries/gha/.github/workflows/linderman-deploy.yaml@main
+    uses: lehigh-university-libraries/gha/.github/workflows/linderman-deploy.yaml@e26d86abfbe300be4d93570b666651c11471995b # main
     with:
       url: https://apps-test.lib.lehigh.edu/_rollout
     secrets: inherit