diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 4a6a5b4..575e799 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -30,7 +30,7 @@ jobs:
       run: |
         echo "sdk_version=$(cat osc_sdk_python/VERSION)" >> "$GITHUB_OUTPUT"
     - name: Create Pull Request
-      uses: peter-evans/create-pull-request@v8.1.0
+      uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
       with:
         committer: "Outscale Bot <opensource+bot@outscale.com>"
         author: "Outscale Bot <opensource+bot@outscale.com>"
diff --git a/.github/workflows/sync-labels.yml b/.github/workflows/sync-labels.yml
index 2453ac7..1acfaf5 100644
--- a/.github/workflows/sync-labels.yml
+++ b/.github/workflows/sync-labels.yml
@@ -9,7 +9,7 @@ jobs:
   sync:
     runs-on: ubuntu-latest
     steps:
-      - uses: EndBug/label-sync@v2
+      - uses: EndBug/label-sync@52074158190acb45f3077f9099fea818aa43f97a # v2
         with:
           config-file: 'https://raw.githubusercontent.com/outscale/.github/main/labels.yml'
           # delete-other-labels: false   # set to true for strict sync