diff --git a/.github/actions/setup-triage-runner/action.yml b/.github/actions/setup-triage-runner/action.yml
index 0a9d402..e69b0a1 100644
--- a/.github/actions/setup-triage-runner/action.yml
+++ b/.github/actions/setup-triage-runner/action.yml
@@ -8,7 +8,7 @@ description: >
 runs:
   using: composite
   steps:
-  - uses: microsoft/playwright/.github/actions/ci-env@main
+  - uses: microsoft/playwright/.github/actions/ci-env@d1518e3e3fca90352c4390814943cced496fd7e4 # main
   - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
     with:
       node-version: '24'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5ee48c9..ba2483b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -105,7 +105,7 @@ jobs:
         npm install -g @github/copilot
     - name: Write the notes with Copilot CLI
       id: agent
-      uses: microsoft/playwright/.github/actions/run-agent@main
+      uses: microsoft/playwright/.github/actions/run-agent@d1518e3e3fca90352c4390814943cced496fd7e4 # main
       with:
         prompt: |
           Write the release notes of @playwright/cli v${{ env.VERSION }}. Follow steps 2 to 7 of .claude/skills/dev/release.md. Read the skill in full before you start.
diff --git a/.github/workflows/revision.yml b/.github/workflows/revision.yml
index 1042041..1d8f5b6 100644
--- a/.github/workflows/revision.yml
+++ b/.github/workflows/revision.yml
@@ -39,7 +39,7 @@ jobs:
     steps:
     - name: Collect the PR and the maintainers' comments
       id: collect
-      uses: microsoft/playwright/.github/actions/collect-review@main
+      uses: microsoft/playwright/.github/actions/collect-review@d1518e3e3fca90352c4390814943cced496fd7e4 # main
       with:
         pull-request: ${{ github.event.pull_request.number }}
     - name: Post the run link
@@ -78,7 +78,7 @@ jobs:
         ref: ${{ needs.prepare.outputs.head }}
         persist-credentials: false
     - name: Rebase on main
-      uses: microsoft/playwright/.github/actions/rebase-pr@main
+      uses: microsoft/playwright/.github/actions/rebase-pr@d1518e3e3fca90352c4390814943cced496fd7e4 # main
       with:
         onto: ${{ needs.prepare.outputs.base }}
     - name: Record the directories
@@ -97,7 +97,7 @@ jobs:
     - name: Revise with Copilot CLI
       id: agent
       # No GitHub tools and no URL access: the agent reads the PR only from the review the prepare job filtered.
-      uses: microsoft/playwright/.github/actions/run-agent@main
+      uses: microsoft/playwright/.github/actions/run-agent@d1518e3e3fca90352c4390814943cced496fd7e4 # main
       with:
         prompt: |
           Follow the shared guide revision.md and this repo's CLAUDE.md. Read both in full before starting. $PLAYWRIGHT_DIR is a clone of microsoft/playwright at the tip of main, where the source of the CLI is, built; read it, but do not edit, commit or switch branches in it.
@@ -132,7 +132,7 @@ jobs:
         path: ${{ runner.temp }}/revision
     # Never execute code or scripts from the artifact in the app job. The calls are data.
     - name: Check and make the calls
-      uses: microsoft/playwright/.github/actions/publish-calls@main
+      uses: microsoft/playwright/.github/actions/publish-calls@d1518e3e3fca90352c4390814943cced496fd7e4 # main
       with:
         token: ${{ steps.app-token.outputs.token }}
         dir: ${{ runner.temp }}/revision
diff --git a/.github/workflows/roll.yml b/.github/workflows/roll.yml
index 8e3b674..d8d4d84 100644
--- a/.github/workflows/roll.yml
+++ b/.github/workflows/roll.yml
@@ -128,7 +128,7 @@ jobs:
       run: npm install -g @github/copilot
     - name: Roll with Copilot CLI
       id: agent
-      uses: microsoft/playwright/.github/actions/run-agent@main
+      uses: microsoft/playwright/.github/actions/run-agent@d1518e3e3fca90352c4390814943cced496fd7e4 # main
       with:
         prompt: |
           Roll Playwright in @playwright/cli from ${{ env.OLD }} to ${{ env.NEW }}. Follow .claude/skills/dev/roll.md, and read CLAUDE.md for how to test.
diff --git a/.github/workflows/triage.yml b/.github/workflows/triage.yml
index e2c294a..399d794 100644
--- a/.github/workflows/triage.yml
+++ b/.github/workflows/triage.yml
@@ -132,7 +132,7 @@ jobs:
         } >> "$GITHUB_OUTPUT"
     - name: Triage with Copilot CLI
       id: agent
-      uses: microsoft/playwright/.github/actions/run-agent@main
+      uses: microsoft/playwright/.github/actions/run-agent@d1518e3e3fca90352c4390814943cced496fd7e4 # main
       with:
         prompt: ${{ steps.prompt.outputs.prompt }}
         output-dir: ${{ env.OUTPUT_DIR }}
@@ -220,7 +220,7 @@ jobs:
     # Never execute code or scripts from the artifact in the app job. The calls are data.
     - name: Check and make the calls
       id: publish
-      uses: microsoft/playwright/.github/actions/publish-calls@main
+      uses: microsoft/playwright/.github/actions/publish-calls@d1518e3e3fca90352c4390814943cced496fd7e4 # main
       with:
         token: ${{ steps.app-token.outputs.token }}
         dir: ${{ runner.temp }}/triage