diff --git a/.github/workflows/backend-build-test.yml b/.github/workflows/backend-build-test.yml
index cc4eb1a0e47..0f73c6c61ac 100644
--- a/.github/workflows/backend-build-test.yml
+++ b/.github/workflows/backend-build-test.yml
@@ -56,7 +56,7 @@ jobs:
           verbose: true
 
       - name: Build Image
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
         with:
           context: ./dist
           file: ./script/docker/server/Dockerfile
diff --git a/.github/workflows/collector-native-build.yml b/.github/workflows/collector-native-build.yml
index d44877dba8f..d5a0f0ed9e9 100644
--- a/.github/workflows/collector-native-build.yml
+++ b/.github/workflows/collector-native-build.yml
@@ -53,7 +53,7 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Set up GraalVM JDK 25
-        uses: graalvm/setup-graalvm@v1
+        uses: graalvm/setup-graalvm@f744c72a42b1995d7b0cbc314bde4bace7ac1fe1
         with:
           distribution: graalvm-community
           java-version: '25'
diff --git a/.github/workflows/doc-build-test.yml b/.github/workflows/doc-build-test.yml
index 0ba8789af51..fbade10714f 100644
--- a/.github/workflows/doc-build-test.yml
+++ b/.github/workflows/doc-build-test.yml
@@ -39,7 +39,7 @@ jobs:
           python-version: '3.8'
 
       - name: Check Markdown
-        uses: DavidAnson/markdownlint-cli2-action@992badcdf24e3b8eb7e87ff9287fe931bcb00c6e
+        uses: DavidAnson/markdownlint-cli2-action@07035fd053f7be764496c0f8d8f9f41f98305101
         with:
           globs: './home/**/*.md'
 
diff --git a/.github/workflows/monitor-e2e-test.yml b/.github/workflows/monitor-e2e-test.yml
index a07b7100d12..5af1300fdf1 100644
--- a/.github/workflows/monitor-e2e-test.yml
+++ b/.github/workflows/monitor-e2e-test.yml
@@ -38,7 +38,7 @@ jobs:
       - name: Build with Maven
         run: mvn clean -B package -Prelease -Dmaven.test.skip=true --file pom.xml
       - name: Build Image
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
         with:
           context: ./dist
           file: ./script/docker/server/Dockerfile
diff --git a/.github/workflows/nightly-build.yml b/.github/workflows/nightly-build.yml
index 7b1847ef49d..0928a8d24da 100644
--- a/.github/workflows/nightly-build.yml
+++ b/.github/workflows/nightly-build.yml
@@ -34,13 +34,13 @@ jobs:
     - uses: pnpm/action-setup@v4
       with:
         version: 10
-        
+
     - name: Build the Frontend
       run: |
         cd web-app
         pnpm install
         pnpm package
-        
+
     - name: Build the Backend
       run: |
         mvn clean install
@@ -48,25 +48,25 @@ jobs:
         cd hertzbeat-collector
         mvn clean package -Pcluster -DskipTests
 
-    - uses: docker/setup-qemu-action@v3
-    - uses: docker/setup-buildx-action@v3
+    - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a
+    - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd
     - name: Log in to Docker Hub
-      uses: docker/login-action@v3
+      uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2
       with:
         username: ${{ secrets.DOCKERHUB_USER }}
         password: ${{ secrets.DOCKERHUB_TOKEN }}
-        
+
     - name: Build and Push Server
-      uses: docker/build-push-action@v6
+      uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
       with:
         context: ./dist
         file: ./script/docker/server/Dockerfile
         platforms: linux/amd64,linux/arm64
         push: true
         tags: apache/hertzbeat:nightly
-        
+
     - name: Build and Push Collector
-      uses: docker/build-push-action@v6
+      uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
       with:
         context: ./dist
         file: ./script/docker/collector/Dockerfile