diff --git a/.gitea/workflows/changelog.yml b/.gitea/workflows/changelog.yml
index 113eca3..56f130e 100644
--- a/.gitea/workflows/changelog.yml
+++ b/.gitea/workflows/changelog.yml
@@ -13,7 +13,7 @@ jobs:
       - name: install tools
         run: |
           apk add -q --update --no-cache nodejs curl jq sed
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
       - name: Generate upcoming changelog
diff --git a/.gitea/workflows/commitlint.yml b/.gitea/workflows/commitlint.yml
index bab0395..7a03da1 100644
--- a/.gitea/workflows/commitlint.yml
+++ b/.gitea/workflows/commitlint.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     container: commitlint/commitlint:21.2.1
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: check PR title
         run: |
           echo "${{ gitea.event.pull_request.title }}" | commitlint --config .commitlintrc.json
diff --git a/.gitea/workflows/release-version.yml b/.gitea/workflows/release-version.yml
index ef08080..1cfb9d8 100644
--- a/.gitea/workflows/release-version.yml
+++ b/.gitea/workflows/release-version.yml
@@ -13,14 +13,14 @@ jobs:
   generate-chart-publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: install Docker CLI
-        uses: https://github.com/docker/setup-buildx-action@v4 # Gitea
+        uses: https://github.com/docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 # Gitea
         #uses: docker/setup-buildx-action@v4 # Github / Act
 
       - name: install Helm
-        uses: https://github.com/Azure/setup-helm@v5 # Gitea
+        uses: https://github.com/Azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5 # Gitea
         #uses: Azure/setup-helm@v5 # Github / Act
         with:
           version: "${{ env.HELM_VERSION }}"
@@ -33,7 +33,7 @@ jobs:
 
       - name: import GPG key
         id: import_gpg
-        uses: https://github.com/crazy-max/ghaction-import-gpg@v7 # Gitea
+        uses: https://github.com/crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7 # Gitea
         #uses: crazy-max/ghaction-import-gpg@v7 # Github / Act
         with:
           gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
@@ -41,7 +41,7 @@ jobs:
           fingerprint: CC64B1DB67ABBEECAB24B6455FC346329753F4B0
 
       - name: log into Docker Hub
-        uses: https://github.com/docker/login-action@v4 # Gitea
+        uses: https://github.com/docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 # Gitea
         #uses: docker/login-action@v4 # Github / Act
         with:
           username: ${{ secrets.DOCKER_CHARTS_USERNAME }}
@@ -68,7 +68,7 @@ jobs:
           TAR_OPTIONS: "--wildcards"
 
       - name: aws credential configure
-        uses: https://github.com/aws-actions/configure-aws-credentials@v6 # Gitea
+        uses: https://github.com/aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6 # Gitea
         #uses: aws-actions/configure-aws-credentials@v6 # Github / Act
         with:
           aws-access-key-id: ${{ secrets.AWS_KEY_ID }}
diff --git a/.gitea/workflows/shellcheck.yml b/.gitea/workflows/shellcheck.yml
index 0fd52bf..d25d1aa 100644
--- a/.gitea/workflows/shellcheck.yml
+++ b/.gitea/workflows/shellcheck.yml
@@ -9,6 +9,6 @@ jobs:
   shellcheck:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - run: apt update --yes && apt install --yes shellcheck
       - run: find . -type f -name "*.sh" -exec shellcheck -a {} \;
diff --git a/.gitea/workflows/test-pr.yml b/.gitea/workflows/test-pr.yml
index 3e78fdc..48244af 100644
--- a/.gitea/workflows/test-pr.yml
+++ b/.gitea/workflows/test-pr.yml
@@ -23,10 +23,10 @@ jobs:
           apk update
           apk add --update bash make nodejs npm yamllint ncurses
       - name: Install pnpm
-        uses: pnpm/action-setup@v6
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
         with:
           version: 11
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: install chart dependencies
         run: helm dependency build
       - name: lint
@@ -49,4 +49,4 @@ jobs:
           git diff --exit-code --name-only README.md
       - name: yaml lint
         # uses: ibiqlik/action-yamllint@v3 # Github / Act
-        uses: https://github.com/ibiqlik/action-yamllint@v3 # Gitea
+        uses: https://github.com/ibiqlik/action-yamllint@2576378a8e339169678f9939646ee3ee325e845c # v3 # Gitea