diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 934633e9a3..be1837eb25 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -28,7 +28,7 @@ jobs:
         id: short-sha
         run: echo "sha=$(git rev-parse --short=12 HEAD)" >> $GITHUB_OUTPUT
       - name: 'Set up Cloud SDK'
-        uses: 'google-github-actions/setup-gcloud@v3'
+        uses: 'google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db'
       - name: Construct tags
         id: construct-tags
         run: |
@@ -52,7 +52,7 @@ jobs:
           ENVIRONMENT_TAG: ${{ steps.construct-tags.outputs.environment-tag }}
       - id: 'auth'
         name: 'Authenticate to Google Cloud'
-        uses: 'google-github-actions/auth@v3'
+        uses: 'google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093'
         with:
           # Centralized in dsp-tools-k8s; ask in #dsp-devops-champions for help troubleshooting
           token_format: 'access_token'
@@ -60,7 +60,7 @@ jobs:
           service_account: 'dsp-artifact-registry-push@dsp-artifact-registry.iam.gserviceaccount.com'
       # authenticate to GAR docker repo
       - name: Docker Login
-        uses: 'docker/login-action@v3'
+        uses: 'docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1'
         with:
           registry: 'us-central1-docker.pkg.dev'
           username: 'oauth2accesstoken'