diff --git a/.github/workflows/chart.yml b/.github/workflows/chart.yml
index 81eb599..29831d2 100644
--- a/.github/workflows/chart.yml
+++ b/.github/workflows/chart.yml
@@ -22,7 +22,7 @@ jobs:
   tests:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v3.5.2
       - uses: werf/actions/install@v1.2
       - name: Werf lint chart
         run: cd "$CHART_DIR" && werf helm lint
@@ -33,7 +33,7 @@ jobs:
     if: "github.event_name == 'push' && github.ref == 'refs/heads/master'"
     needs: tests
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v3.5.2
       - uses: werf/actions/install@v1.2
       - name: Package werf charts
         run: |
@@ -43,4 +43,4 @@ jobs:
         run: |
           while read package; do
             curl -sSL --post301 --data-binary "@.packages/$package" --user "${{ secrets.CHARTMUSEUM_BASIC_AUTH_USER }}:${{ secrets.CHARTMUSEUM_BASIC_AUTH_PASS }}" "$CHARTMUSEUM_URL"
-          done < <(find .packages -mindepth 1 -maxdepth 1 -type f -name '*.tgz' -exec sh -c 'basename "$0"' '{}' \;)
\ No newline at end of file
+          done < <(find .packages -mindepth 1 -maxdepth 1 -type f -name '*.tgz' -exec sh -c 'basename "$0"' '{}' \;)
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 91a7ee9..7247cea 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,17 +19,17 @@ jobs:
       with:
         go-version: '1.19'
 
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v3.5.2
 
     - name: Test With Coverage
       run: go test -v -race  -coverprofile=coverage.txt -covermode=atomic ./...
     - name: Upload coverage to Codecov
-      uses: codecov/codecov-action@v2
+      uses: codecov/codecov-action@v3.1.4
       with:
         files: coverage.txt
 
     - name: golangci-lint
-      uses: golangci/golangci-lint-action@v3
+      uses: golangci/golangci-lint-action@v3.4.0
       with:
         args: --timeout=5m
         # since go test already does it in a previous step
@@ -41,12 +41,12 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v3.5.2
       # Login against a Docker registry except on PR
       # https://github.com/docker/login-action
       - name: Log into registry ${{ env.REGISTRY }}
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@28218f9b04b4f3f62068d7b6ce6ca5b26e35336c
+        uses: docker/login-action@v2.1.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ secrets.DECKHOUSE_REGISTRY_USER }}
@@ -55,15 +55,15 @@ jobs:
       # https://github.com/docker/metadata-action
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
+        uses: docker/metadata-action@v4.4.0
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
       # Build and push Docker image with Buildx (don't push on PR)
       # https://github.com/docker/build-push-action
       - name: Build and push Docker image
-        uses: docker/build-push-action@ad44023a93711e3deb337508980b4b5e9bcdc5dc
+        uses: docker/build-push-action@v4.0.0
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
\ No newline at end of file
+          labels: ${{ steps.meta.outputs.labels }}