diff --git a/.github/workflows/create-cherry-pick-pr.yml b/.github/workflows/create-cherry-pick-pr.yml
index ecdd770e02776..108dd9944ab77 100644
--- a/.github/workflows/create-cherry-pick-pr.yml
+++ b/.github/workflows/create-cherry-pick-pr.yml
@@ -177,7 +177,7 @@ jobs:
 
             return commentBody;
 
-      - uses: microsoft/typescript-bot-test-triggerer/.github/actions/post-workflow-result@master
+      - uses: microsoft/typescript-bot-test-triggerer/.github/actions/post-workflow-result@7676a9e9baa8a77a92206e4a9d434bbe45c81959 # master
         if: ${{ !cancelled() && inputs.distinct_id }}
         with:
           success_comment: ${{ steps.open-pr.outputs.result }}
diff --git a/.github/workflows/new-release-branch.yaml b/.github/workflows/new-release-branch.yaml
index 06a52bd6cc9f5..445fede40f5a1 100644
--- a/.github/workflows/new-release-branch.yaml
+++ b/.github/workflows/new-release-branch.yaml
@@ -87,7 +87,7 @@ jobs:
           git commit -m "Bump version to $PACKAGE_VERSION and LKG"
           git push --set-upstream origin "$BRANCH_NAME"
 
-      - uses: microsoft/typescript-bot-test-triggerer/.github/actions/post-workflow-result@master
+      - uses: microsoft/typescript-bot-test-triggerer/.github/actions/post-workflow-result@7676a9e9baa8a77a92206e4a9d434bbe45c81959 # master
         if: ${{ !cancelled() && inputs.distinct_id }}
         with:
           success_comment: "I've created ${{ inputs.branch_name }} with version ${{ inputs.package_version }} for you."
diff --git a/.github/workflows/set-version.yaml b/.github/workflows/set-version.yaml
index cd32ffd0028d8..47c86c58dc753 100644
--- a/.github/workflows/set-version.yaml
+++ b/.github/workflows/set-version.yaml
@@ -90,7 +90,7 @@ jobs:
           git commit -m "Bump version to $PACKAGE_VERSION and LKG"
           git push
 
-      - uses: microsoft/typescript-bot-test-triggerer/.github/actions/post-workflow-result@master
+      - uses: microsoft/typescript-bot-test-triggerer/.github/actions/post-workflow-result@7676a9e9baa8a77a92206e4a9d434bbe45c81959 # master
         if: ${{ !cancelled() && inputs.distinct_id }}
         with:
           success_comment: "I've set the version of ${{ inputs.branch_name }} to ${{ inputs.package_version }} for you."
diff --git a/.github/workflows/sync-branch.yaml b/.github/workflows/sync-branch.yaml
index e3bb90894abc3..9b82f927795bd 100644
--- a/.github/workflows/sync-branch.yaml
+++ b/.github/workflows/sync-branch.yaml
@@ -64,7 +64,7 @@ jobs:
           git commit -m 'Update LKG'
           git push
 
-      - uses: microsoft/typescript-bot-test-triggerer/.github/actions/post-workflow-result@master
+      - uses: microsoft/typescript-bot-test-triggerer/.github/actions/post-workflow-result@7676a9e9baa8a77a92206e4a9d434bbe45c81959 # master
         if: ${{ !cancelled() && inputs.distinct_id }}
         with:
           success_comment: "I've pulled main into ${{ inputs.branch_name }} for you."
diff --git a/.github/workflows/twoslash-repros.yaml b/.github/workflows/twoslash-repros.yaml
index 26de5f9d70d55..29440db9ffc83 100644
--- a/.github/workflows/twoslash-repros.yaml
+++ b/.github/workflows/twoslash-repros.yaml
@@ -60,7 +60,7 @@ jobs:
       - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: 'lts/*'
-      - uses: microsoft/TypeScript-Twoslash-Repro-Action@master
+      - uses: microsoft/TypeScript-Twoslash-Repro-Action@896a8519c4a94659aae0e27c9c92d6115bfb6ad8 # master
         with:
           github-token: ${{ secrets.TS_BOT_GITHUB_TOKEN }}
           issue: ${{ github.event.inputs.issue }}