diff --git a/.github/workflows/release-go-github.yml b/.github/workflows/release-go-github.yml
index 0ea058b..2b4fc27 100644
--- a/.github/workflows/release-go-github.yml
+++ b/.github/workflows/release-go-github.yml
@@ -32,12 +32,12 @@ jobs:
             goos: windows
     steps:
     - name: Checkout Code
-      uses: actions/checkout@v6
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         persist-credentials: false
 
     - name: Release Go Application
-      uses: wangyoucao577/go-release-action@v1
+      uses: wangyoucao577/go-release-action@279495102627de7960cbc33434ab01a12bae144b # v1.55
       id: go_release
       with:
         github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -50,7 +50,7 @@ jobs:
         sha256sum: true
 
     - name: GitHub Attestation for Artifacts
-      uses: actions/attest-build-provenance@v3
+      uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # v3.2.0
       with:
         subject-path: |
           "${{ steps.go_release.outputs.release_asset_dir }}/*"