diff --git a/.github/workflows/publish-openai-sdk-python.yml b/.github/workflows/publish-openai-sdk-python.yml
index e6066bcf..d5232e8d 100644
--- a/.github/workflows/publish-openai-sdk-python.yml
+++ b/.github/workflows/publish-openai-sdk-python.yml
@@ -23,20 +23,22 @@ jobs:
                 working-directory: ./packages/openai-sdk-python
         steps:
             - name: Checkout
-              uses: actions/checkout@v4
+              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+              with:
+                persist-credentials: false
 
             - name: Setup Python
-              uses: actions/setup-python@v5
+              uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
               with:
                 python-version: "3.12"
 
             - name: Install build dependencies
-              run: pip install hatchling build
+              run: python -m pip install hatchling build
 
             - name: Build package
               run: python -m build
 
             - name: Publish to PyPI
-              uses: pypa/gh-action-pypi-publish@release/v1
+              uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
               with:
                 packages-dir: packages/openai-sdk-python/dist/