diff --git a/.github/workflows/build_esp32.yml b/.github/workflows/build_esp32.yml
index 7996a9b1b..c9664152e 100644
--- a/.github/workflows/build_esp32.yml
+++ b/.github/workflows/build_esp32.yml
@@ -17,11 +17,11 @@ jobs:
         uses: ./.github/actions/setup-base
 
       - name: Pull web ui
-        uses: dsaltares/fetch-gh-release-asset@master
+        uses: dsaltares/fetch-gh-release-asset@a40c8b4a0471f9ab81bdf73a010f74cc51476ad4
         with:
-          repo: "meshtastic/web"
-          file: "build.tar"
-          target: "build.tar"
+          repo: meshtastic/web
+          file: build.tar
+          target: build.tar
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Unpack web ui
@@ -40,11 +40,11 @@ jobs:
         run: bin/build-esp32.sh ${{ inputs.board }}
 
       - name: Pull OTA Firmware
-        uses: dsaltares/fetch-gh-release-asset@master
+        uses: dsaltares/fetch-gh-release-asset@a40c8b4a0471f9ab81bdf73a010f74cc51476ad4
         with:
-          repo: "meshtastic/firmware-ota"
-          file: "firmware.bin"
-          target: "release/bleota.bin"
+          repo: meshtastic/firmware-ota
+          file: firmware.bin
+          target: release/bleota.bin
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Get release version string
diff --git a/.github/workflows/build_esp32_s3.yml b/.github/workflows/build_esp32_s3.yml
index 7f556a991..9611dd5b8 100644
--- a/.github/workflows/build_esp32_s3.yml
+++ b/.github/workflows/build_esp32_s3.yml
@@ -17,11 +17,11 @@ jobs:
         uses: ./.github/actions/setup-base
 
       - name: Pull web ui
-        uses: dsaltares/fetch-gh-release-asset@master
+        uses: dsaltares/fetch-gh-release-asset@a40c8b4a0471f9ab81bdf73a010f74cc51476ad4
         with:
-          repo: "meshtastic/web"
-          file: "build.tar"
-          target: "build.tar"
+          repo: meshtastic/web
+          file: build.tar
+          target: build.tar
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Unpack web ui
@@ -38,11 +38,11 @@ jobs:
         run: bin/build-esp32.sh ${{ inputs.board }}
 
       - name: Pull OTA Firmware
-        uses: dsaltares/fetch-gh-release-asset@master
+        uses: dsaltares/fetch-gh-release-asset@a40c8b4a0471f9ab81bdf73a010f74cc51476ad4
         with:
-          repo: "meshtastic/firmware-ota"
-          file: "firmware-s3.bin"
-          target: "release/bleota-s3.bin"
+          repo: meshtastic/firmware-ota
+          file: firmware-s3.bin
+          target: release/bleota-s3.bin
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Get release version string
diff --git a/.github/workflows/main_matrix.yml b/.github/workflows/main_matrix.yml
index 01535306e..b4a8a4739 100644
--- a/.github/workflows/main_matrix.yml
+++ b/.github/workflows/main_matrix.yml
@@ -49,7 +49,7 @@ jobs:
 
       - name: Trunk Check
         if: ${{ github.event_name != 'workflow_dispatch' }}
-        uses: trunk-io/trunk-action@v1
+        uses: trunk-io/trunk-action@782e83f803ca6e369f035d64c6ba2768174ba61b
 
       - name: Check ${{ matrix.board }}
         run: bin/check-all.sh ${{ matrix.board }}
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index d9d52a2a4..da59bc0fd 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -14,6 +14,6 @@ jobs:
         uses: actions/checkout@v3
 
       - name: Trunk Check
-        uses: trunk-io/trunk-action@v1
+        uses: trunk-io/trunk-action@782e83f803ca6e369f035d64c6ba2768174ba61b
         with:
           trunk-token: ${{ secrets.TRUNK_TOKEN }}