diff --git a/.github/workflows/check-merge.yml b/.github/workflows/check-merge.yml
index a4b4ddb99e..cfeb587de4 100644
--- a/.github/workflows/check-merge.yml
+++ b/.github/workflows/check-merge.yml
@@ -13,7 +13,7 @@ jobs:
     steps:
       - name: Check if there is already a block on this PR
         id: blocked
-        uses: actions/github-script@v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         env:
           issue_number:  ${{ github.event.number }}
         with:
@@ -32,7 +32,7 @@ jobs:
             return 'false'
           result-encoding: string
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         if: steps.blocked.outputs.result != 'true'
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
@@ -41,7 +41,7 @@ jobs:
 
       - name: Get changed files in the .changeset folder
         id: changed-files
-        uses: tj-actions/changed-files@v45
+        uses: tj-actions/changed-files@a284dc1814e3fd07f2e34267fc8f81227ed29fb8 # v45.0.9
         if: steps.blocked.outputs.result != 'true'
         with:
           files: |
@@ -67,7 +67,7 @@ jobs:
           done
 
       - name: Add label
-        uses: actions/github-script@v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         if: steps.check.outputs.found == 'true'
         env:
           issue_number: ${{ github.event.number }}
@@ -81,7 +81,7 @@ jobs:
             });
 
       - name: Change PR Status
-        uses: actions/github-script@v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         if: steps.check.outputs.found == 'true'
         env:
           issue_number: ${{ github.event.number }}