diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3414db33..0f5452c8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -202,7 +202,7 @@ jobs:
           grep -F '/probe.sh' <<< "${healthcheck}"
 
       - name: Scan image with VEX-aware Trivy and Grype
-        uses: StackVista/image-pipeline/.github/actions/scan-image@ec325c73909d0d00420121bbde6754b964e80ac3
+        uses: StackVista/image-pipeline/.github/actions/scan-image@79dd6718168651ffc846eed98c3c0cb646eb15a0 # v1.0.1
         with:
           image: ${{ env.IMAGE }}:${{ steps.image.outputs.tag }}-${{ matrix.arch }}
           mode: inform
@@ -274,7 +274,7 @@ jobs:
 
       - name: Resolve canonical OCI labels
         id: oci
-        uses: StackVista/image-pipeline/.github/actions/apply-oci-labels@6284a6fc006a7cc46a7f00d02c50d5f21b117b63
+        uses: StackVista/image-pipeline/.github/actions/apply-oci-labels@79dd6718168651ffc846eed98c3c0cb646eb15a0 # v1.0.1
         with:
           image-name: stackstate-k8s-process-agent
           tag: ${{ steps.image.outputs.tag }}
@@ -285,7 +285,7 @@ jobs:
           base-name: registry.suse.com/bci/bci-micro:15.7@sha256:f1427da6f40791aa5a9f73bb339674970ea93a2b158adc81bc99bcd1b7899a74
 
       - name: Build, publish, and sign architecture image
-        uses: StackVista/image-pipeline/.github/actions/push-single-arch@6284a6fc006a7cc46a7f00d02c50d5f21b117b63
+        uses: StackVista/image-pipeline/.github/actions/push-single-arch@79dd6718168651ffc846eed98c3c0cb646eb15a0 # v1.0.1
         with:
           image: ${{ env.IMAGE }}
           tag: ${{ steps.image.outputs.tag }}
@@ -325,7 +325,7 @@ jobs:
           echo "tag=${short_sha}" >> "${GITHUB_OUTPUT}"
 
       - name: Merge and sign multi-architecture manifest
-        uses: StackVista/image-pipeline/.github/actions/merge-multiarch@6284a6fc006a7cc46a7f00d02c50d5f21b117b63
+        uses: StackVista/image-pipeline/.github/actions/merge-multiarch@79dd6718168651ffc846eed98c3c0cb646eb15a0 # v1.0.1
         with:
           image: ${{ env.IMAGE }}
           tag: ${{ steps.image.outputs.tag }}