diff --git a/.forgejo/workflows/publish.yaml b/.forgejo/workflows/publish.yaml
index dce4216a51e..cfe571ff47d 100644
--- a/.forgejo/workflows/publish.yaml
+++ b/.forgejo/workflows/publish.yaml
@@ -63,7 +63,7 @@ jobs:
       image: git.snaile.de/snailed/xbps-builder:${{ matrix.config.libc }}-latest
     steps:
       - name: Clone and checkout
-        uses: https://github.com/classabbyamp/treeless-checkout-action@v1
+        uses: https://github.com/classabbyamp/treeless-checkout-action@bd3615a6e9d5546151e17d72193eea0d6f297398 # v1
 
       - name: Prepare container
         run: |
diff --git a/.forgejo/workflows/test.yaml b/.forgejo/workflows/test.yaml
index cde9b19e4d3..43716139692 100644
--- a/.forgejo/workflows/test.yaml
+++ b/.forgejo/workflows/test.yaml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
 
     container:
-      image: "ghcr.io/void-linux/void-buildroot-musl:20231230R1"
+      image: "ghcr.io/void-linux/void-buildroot-musl:20231230R1@sha256:40ab4dfdf55c3f2988f788780898093f1d6b808f5d3720aa836a7192c71bcad9"
       env:
         PATH: "/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/sbin:/usr/local/bin:/tmp/bin"
         LICENSE_LIST: common/travis/license.lst
@@ -41,7 +41,7 @@ jobs:
           # install tools needed for lints
           xbps-install -y grep curl git
       - name: Clone and checkout
-        uses: https://github.com/classabbyamp/treeless-checkout-action@v1
+        uses: https://github.com/classabbyamp/treeless-checkout-action@bd3615a6e9d5546151e17d72193eea0d6f297398 # v1
       - name: Create hostrepo and prepare masterdir
         run: |
           ln -s "$(pwd)" /hostrepo &&
@@ -130,7 +130,7 @@ jobs:
           xbps-install -yu
 
       - name: Clone and checkout
-        uses: https://github.com/classabbyamp/treeless-checkout-action@v1
+        uses: https://github.com/classabbyamp/treeless-checkout-action@bd3615a6e9d5546151e17d72193eea0d6f297398 # v1
       - name: Create hostrepo and prepare masterdir
         run: |
           ln -s "$(pwd)" /hostrepo &&