diff --git a/.gitea/workflows/build-pcm.yml b/.gitea/workflows/build-pcm.yml
index d17d6e9..6fe64c8 100644
--- a/.gitea/workflows/build-pcm.yml
+++ b/.gitea/workflows/build-pcm.yml
@@ -10,7 +10,9 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      # third-party actions pinned to commit SHAs: mutable tags could be
+      # repointed at malicious code that runs with repo/token access
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Check tag matches metadata.json version
         if: startsWith(github.ref, 'refs/tags/v')
@@ -26,7 +28,7 @@ jobs:
         run: python3 tools/build_package.py
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3
         with:
           name: pcm-package
           path: |
@@ -35,7 +37,7 @@ jobs:
 
       - name: Create release with the zip attached
         if: startsWith(github.ref, 'refs/tags/v')
-        uses: akkuman/gitea-release-action@v1
+        uses: akkuman/gitea-release-action@b8d9144f302c68610911db1aaf722708d5c02d94 # v1
         with:
           files: |
             dist/*.zip