diff --git a/.github/actions/setup-triage-runner/action.yml b/.github/actions/setup-triage-runner/action.yml
index 096d1335f..622b3d58c 100644
--- a/.github/actions/setup-triage-runner/action.yml
+++ b/.github/actions/setup-triage-runner/action.yml
@@ -8,7 +8,7 @@ description: >
 runs:
   using: composite
   steps:
-  - uses: microsoft/playwright/.github/actions/ci-env@main
+  - uses: microsoft/playwright/.github/actions/ci-env@d1518e3e3fca90352c4390814943cced496fd7e4 # main
   - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
     with:
       distribution: zulu
diff --git a/.github/workflows/revision.yml b/.github/workflows/revision.yml
index 63f3bd374..66b9d9664 100644
--- a/.github/workflows/revision.yml
+++ b/.github/workflows/revision.yml
@@ -37,7 +37,7 @@ jobs:
     steps:
     - name: Collect the PR and the maintainers' comments
       id: collect
-      uses: microsoft/playwright/.github/actions/collect-review@main
+      uses: microsoft/playwright/.github/actions/collect-review@d1518e3e3fca90352c4390814943cced496fd7e4 # main
       with:
         pull-request: ${{ github.event.pull_request.number }}
     - name: Post the run link
@@ -92,7 +92,7 @@ jobs:
     - name: Revise with Copilot CLI
       id: agent
       # No GitHub tools and no URL access: the agent reads the PR only from the review the prepare job filtered.
-      uses: microsoft/playwright/.github/actions/run-agent@main
+      uses: microsoft/playwright/.github/actions/run-agent@d1518e3e3fca90352c4390814943cced496fd7e4 # main
       with:
         prompt: |
           Follow the shared guide revision.md and this repo's AGENTS.md. Read both in full before starting. $PLAYWRIGHT_DIR is a shallow clone of microsoft/playwright at main, for reading the JavaScript client that this repo ports.
@@ -127,7 +127,7 @@ jobs:
         path: ${{ runner.temp }}/revision
     # Never execute code or scripts from the artifact in the app job. The calls are data.
     - name: Check and make the calls
-      uses: microsoft/playwright/.github/actions/publish-calls@main
+      uses: microsoft/playwright/.github/actions/publish-calls@d1518e3e3fca90352c4390814943cced496fd7e4 # main
       with:
         token: ${{ steps.app-token.outputs.token }}
         dir: ${{ runner.temp }}/revision
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index ecd7c0bfa..82ea1131c 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -24,7 +24,7 @@ jobs:
         shell: bash
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - uses: microsoft/playwright/.github/actions/ci-env@main
+    - uses: microsoft/playwright/.github/actions/ci-env@d1518e3e3fca90352c4390814943cced496fd7e4 # main
     - name: Set up JDK 1.8
       uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
       with:
@@ -71,7 +71,7 @@ jobs:
         shell: bash
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: microsoft/playwright/.github/actions/ci-env@main
+      - uses: microsoft/playwright/.github/actions/ci-env@d1518e3e3fca90352c4390814943cced496fd7e4 # main
       - name: Install Media Pack
         if: runner.os == 'Windows'
         shell: powershell
@@ -103,7 +103,7 @@ jobs:
     runs-on: playwright-x64-ubuntu24-64-core
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: microsoft/playwright/.github/actions/ci-env@main
+      - uses: microsoft/playwright/.github/actions/ci-env@d1518e3e3fca90352c4390814943cced496fd7e4 # main
       - name: Set up JDK 25
         uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
diff --git a/.github/workflows/triage.yml b/.github/workflows/triage.yml
index 16ebb7f4d..a44a9b0c9 100644
--- a/.github/workflows/triage.yml
+++ b/.github/workflows/triage.yml
@@ -126,7 +126,7 @@ jobs:
         } >> "$GITHUB_OUTPUT"
     - name: Triage with Copilot CLI
       id: agent
-      uses: microsoft/playwright/.github/actions/run-agent@main
+      uses: microsoft/playwright/.github/actions/run-agent@d1518e3e3fca90352c4390814943cced496fd7e4 # main
       with:
         prompt: ${{ steps.prompt.outputs.prompt }}
         output-dir: ${{ env.OUTPUT_DIR }}
@@ -193,7 +193,7 @@ jobs:
     # Never execute code or scripts from the artifact in the app job. The calls are data.
     - name: Check and make the calls
       id: publish
-      uses: microsoft/playwright/.github/actions/publish-calls@main
+      uses: microsoft/playwright/.github/actions/publish-calls@d1518e3e3fca90352c4390814943cced496fd7e4 # main
       with:
         token: ${{ steps.app-token.outputs.token }}
         dir: ${{ runner.temp }}/triage