diff --git a/.github/workflows/benchmark.yaml b/.github/workflows/benchmark.yaml
index b1140da79..2481f3cfa 100644
--- a/.github/workflows/benchmark.yaml
+++ b/.github/workflows/benchmark.yaml
@@ -16,10 +16,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout current branch
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
 
       - name: Set up Go ${{ env.golang-version }}
-        uses: actions/setup-go@v3.5.0
+        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version: ${{ env.golang-version }}
         id: go
@@ -34,7 +34,7 @@ jobs:
           path: current.txt
 
       - name: Checkout master branch
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         with:
           ref: 'master'
 
diff --git a/.github/workflows/docker-compose-tests.yml b/.github/workflows/docker-compose-tests.yml
index a03c3c3e5..4063159e9 100644
--- a/.github/workflows/docker-compose-tests.yml
+++ b/.github/workflows/docker-compose-tests.yml
@@ -20,10 +20,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v3
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
 
     - name: Set up Go ${{ env.golang-version }}
-      uses: actions/setup-go@v3.5.0
+      uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
       with:
         go-version: ${{ env.golang-version }}
       id: go
diff --git a/.github/workflows/go-e2e.yml b/.github/workflows/go-e2e.yml
index 08e798f9a..0998906c5 100644
--- a/.github/workflows/go-e2e.yml
+++ b/.github/workflows/go-e2e.yml
@@ -37,7 +37,7 @@ jobs:
       docker_image_15:  ${{ steps.metadata.outputs.docker_image_15 }}
     steps:
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v3
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       with:
         repository: timescale/promscale
         ref: ${{ inputs.ref }}
@@ -88,7 +88,7 @@ jobs:
         # - {name: "Multinode",                shortname: "multinode",      multi: true,  pg: 14}
     steps:
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v3
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       with:
         repository: timescale/promscale
         ref: ${{ inputs.ref }}
@@ -97,7 +97,7 @@ jobs:
       run: wget https://github.com/timescale/promscale-test-data/raw/main/traces-dataset.sz -O pkg/tests/testdata/traces-dataset.sz
 
     - name: Set up Go ${{ env.golang-version }}
-      uses: actions/setup-go@v3.5.0
+      uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
       with:
         go-version: ${{ env.golang-version }}
       id: go
@@ -139,13 +139,13 @@ jobs:
         # - {name: "Multinode",                shortname: "multinode",      multi: true,  pg: 14}
     steps:
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v3
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       with:
         repository: timescale/promscale
         ref: ${{ inputs.ref }}
 
     - name: Set up Go ${{ env.golang-version }}
-      uses: actions/setup-go@v3.5.0
+      uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
       with:
         go-version: ${{ env.golang-version }}
       id: go
@@ -178,13 +178,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v3
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       with:
         repository: timescale/promscale
         ref: ${{ inputs.ref }}
 
     - name: Set up Go ${{ env.golang-version }}
-      uses: actions/setup-go@v3.5.0
+      uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
       with:
         go-version: ${{ env.golang-version }}
       id: go
diff --git a/.github/workflows/go-releaser.yml b/.github/workflows/go-releaser.yml
index d19ad50bd..460d43570 100644
--- a/.github/workflows/go-releaser.yml
+++ b/.github/workflows/go-releaser.yml
@@ -21,13 +21,13 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         with:
           fetch-depth: 0
 
       -
         name: Set up Go
-        uses: actions/setup-go@v3.5.0
+        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
           go-version: ${{ env.golang-version }}
       -
diff --git a/.github/workflows/go-scheduled.yml b/.github/workflows/go-scheduled.yml
index 5b71349f9..aa778f06a 100644
--- a/.github/workflows/go-scheduled.yml
+++ b/.github/workflows/go-scheduled.yml
@@ -20,10 +20,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v3
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
 
     - name: Set up Go ${{ env.golang-version }}
-      uses: actions/setup-go@v3.5.0
+      uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
       with:
         go-version: ${{ env.golang-version }}
       id: go
@@ -44,7 +44,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v3
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       with:
         lfs: true
 
@@ -52,7 +52,7 @@ jobs:
       run: git lfs checkout 
 
     - name: Set up Go ${{ env.golang-version }}
-      uses: actions/setup-go@v3.5.0
+      uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
       with:
         go-version: ${{ env.golang-version }}
       id: go
diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index 403923a2a..117dd100e 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Check out code
-      uses: actions/checkout@v3
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
 
     - name: Run ShellCheck
       run: make shellcheck
@@ -30,10 +30,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v3
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
 
     - name: Set up Go ${{ env.golang-version }}
-      uses: actions/setup-go@v3.5.0
+      uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
       with:
         go-version: ${{ env.golang-version }}
       id: go
@@ -61,13 +61,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v3
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
 
     - name: Checkout test data files
       run: wget https://github.com/timescale/promscale-test-data/raw/main/traces-dataset.sz -O pkg/tests/testdata/traces-dataset.sz
 
     - name: Set up Go ${{ env.golang-version }}
-      uses: actions/setup-go@v3.5.0
+      uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
       with:
         go-version: ${{ env.golang-version }}
       id: go
@@ -104,10 +104,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v3
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
 
     - name: Set up Go ${{ env.golang-version }}
-      uses: actions/setup-go@v3.5.0
+      uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
       with:
         go-version: ${{ env.golang-version }}
 
diff --git a/.github/workflows/gosec.yml b/.github/workflows/gosec.yml
index a5ada5ae7..c5d2ff912 100644
--- a/.github/workflows/gosec.yml
+++ b/.github/workflows/gosec.yml
@@ -14,7 +14,7 @@ jobs:
       GO111MODULE: on
     steps:
       - name: Checkout Source
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       - name: Run Gosec Security Scanner
         uses: securego/gosec@v2.14.0
         with:
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index d57641049..38a7c9c23 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -26,10 +26,10 @@ jobs:
           #- 12
     steps:
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v3
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
 
     - name: Set up Go ${{ env.golang-version }}
-      uses: actions/setup-go@v3.5.0
+      uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
       with:
         go-version: ${{ env.golang-version }}
       id: go
diff --git a/.github/workflows/mixin.yml b/.github/workflows/mixin.yml
index b9e126445..122ca1f4b 100644
--- a/.github/workflows/mixin.yml
+++ b/.github/workflows/mixin.yml
@@ -19,15 +19,15 @@ jobs:
     runs-on: ubuntu-latest
     name: Check monitoring mixin
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
 
     - name: Set up Go ${{ env.golang-version }}
-      uses: actions/setup-go@v3.5.0
+      uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
       with:
         go-version: ${{ env.golang-version }}
       id: go
 
-    - uses: actions/setup-go@v3
+    - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4
       with:
         go-version: ${{ env.golang-version }}