diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index 917b15c09..a67f4073e 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -24,7 +24,7 @@ jobs:
       - name: Run benchmarks
         run: make benchmark | tee output.txt
       - name: Download previous benchmark data
-        uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4
+        uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
           path: ./benchmarks
           # `github.event.before` means the commit before the push (i.e. the previous commit).
@@ -44,7 +44,7 @@ jobs:
           # Add benchmark summary to GitHub workflow run report
           summary-always: true
       - name: Save benchmark data
-        uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 # v4
+        uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         # The cache will be saved even if a step fails.
         if: always()
         with:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 11bd71d00..e145eafef 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -30,7 +30,7 @@ jobs:
           check-latest: true
           cache-dependency-path: "**/go.sum"
       - name: Tools cache
-        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         env:
           cache-name: go-tools-cache
         with:
diff --git a/.github/workflows/links-fail-fast.yml b/.github/workflows/links-fail-fast.yml
index 5e9b8ae53..43da6c57f 100644
--- a/.github/workflows/links-fail-fast.yml
+++ b/.github/workflows/links-fail-fast.yml
@@ -18,7 +18,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Restore lychee cache
-        uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4
+        uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         id: cache-restore
         with:
           path: .lycheecache
@@ -35,7 +35,7 @@ jobs:
 
       - name: Save lychee cache
         if: always()
-        uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 # v4
+        uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
           path: .lycheecache
           key: ${{ steps.cache-restore.outputs.cache-primary-key }}
diff --git a/.github/workflows/links.yml b/.github/workflows/links.yml
index 081e009d8..83690979d 100644
--- a/.github/workflows/links.yml
+++ b/.github/workflows/links.yml
@@ -21,7 +21,7 @@ jobs:
 
 
     - name: Restore lychee cache
-      uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4
+      uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
       id: cache-restore
       with:
         path: .lycheecache
@@ -38,7 +38,7 @@ jobs:
 
     - name: Save lychee cache
       if: always()
-      uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 # v4
+      uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
       with:
         path: .lycheecache
         key: ${{ steps.cache-restore.outputs.cache-primary-key }}