diff --git a/.github/workflows/actions-budget-watchdog.yml b/.github/workflows/actions-budget-watchdog.yml
index d221622..49f09e5 100644
--- a/.github/workflows/actions-budget-watchdog.yml
+++ b/.github/workflows/actions-budget-watchdog.yml
@@ -41,7 +41,7 @@ concurrency:
 
 jobs:
   budget:
-    uses: 'JorisJonkers-dev/github-workflows/.github/workflows/actions-budget-watchdog.yml@main'
+    uses: 'JorisJonkers-dev/github-workflows/.github/workflows/actions-budget-watchdog.yml@010c41ce5319572a810de7ed5cd070103298cddc' # main
     with:
       # Literal numbers, not interpolated expressions: these inputs are
       # `type: number` on the callee.
diff --git a/.github/workflows/add-to-project-caller.yml b/.github/workflows/add-to-project-caller.yml
index 236deed..b6860ac 100644
--- a/.github/workflows/add-to-project-caller.yml
+++ b/.github/workflows/add-to-project-caller.yml
@@ -17,7 +17,7 @@ permissions:
 
 jobs:
   add-to-project:
-    uses: 'JorisJonkers-dev/github-workflows/.github/workflows/add-to-project.yml@main'
+    uses: 'JorisJonkers-dev/github-workflows/.github/workflows/add-to-project.yml@010c41ce5319572a810de7ed5cd070103298cddc' # main
     secrets:
       PROJECT_AUTOMATION_APP_ID: '${{ secrets.RELEASE_APP_ID }}'
       PROJECT_AUTOMATION_APP_PRIVATE_KEY: '${{ secrets.RELEASE_APP_PRIVATE_KEY }}'
diff --git a/.github/workflows/org-hygiene-sweep.yml b/.github/workflows/org-hygiene-sweep.yml
index cbfc756..b1ed5f9 100644
--- a/.github/workflows/org-hygiene-sweep.yml
+++ b/.github/workflows/org-hygiene-sweep.yml
@@ -36,7 +36,7 @@ concurrency:
 
 jobs:
   sweep:
-    uses: 'JorisJonkers-dev/github-workflows/.github/workflows/repository-hygiene-sweep.yml@main'
+    uses: 'JorisJonkers-dev/github-workflows/.github/workflows/repository-hygiene-sweep.yml@010c41ce5319572a810de7ed5cd070103298cddc' # main
     with:
       # No exclusions: fleet-infra and nix-config dropped their per-PR guards,
       # so the sweep is now their only hygiene coverage. Anything listed here
diff --git a/.github/workflows/org-project-sweep.yml b/.github/workflows/org-project-sweep.yml
index f9d4e4d..7ce959c 100644
--- a/.github/workflows/org-project-sweep.yml
+++ b/.github/workflows/org-project-sweep.yml
@@ -39,7 +39,7 @@ concurrency:
 
 jobs:
   sweep:
-    uses: 'JorisJonkers-dev/github-workflows/.github/workflows/add-to-project.yml@main'
+    uses: 'JorisJonkers-dev/github-workflows/.github/workflows/add-to-project.yml@010c41ce5319572a810de7ed5cd070103298cddc' # main
     with:
       scope: 'org'
       project-url: "${{ inputs.project-url || 'https://github.com/orgs/JorisJonkers-dev/projects/2' }}"