diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5c9efd5..eb52537 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,8 +14,8 @@ jobs:
     name: Manifest, language and package checks
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: shivammathur/setup-php@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: '8.4'
           coverage: none
@@ -26,6 +26,8 @@ jobs:
             sudo apt-get install -y -q libxml2-utils > /dev/null
           }
           find . -name '*.xml' -not -path './.git/*' -print0 | xargs -0 xmllint --noout
+      - name: Actions are pinned to commit SHAs
+        run: php tests/lint/check-workflows.php
       - name: The Joomla! packages of the matrix have checksums
         run: php tests/lint/check-joomla-checksums.php
       - name: Language files
@@ -51,8 +53,8 @@ jobs:
       matrix:
         php: ['8.1', '8.4']
     steps:
-      - uses: actions/checkout@v7
-      - uses: shivammathur/setup-php@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: ${{ matrix.php }}
           tools: phpunit:11
@@ -87,7 +89,7 @@ jobs:
         run: |
           echo "JOOMLA_ROOT=$RUNNER_TEMP/joomla" >> "$GITHUB_ENV"
           echo "COM_BFSTOP_ROOT=$RUNNER_TEMP/com_bfstop" >> "$GITHUB_ENV"
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # use the com_bfstop branch of the same name if there is one and it
       # has commits main hasn't (for changes spanning both), else main: a
@@ -109,7 +111,7 @@ jobs:
           fi
           echo "ref=$ref" >> "$GITHUB_OUTPUT"
           echo "Using com_bfstop $ref (a branch '$branch' there is ahead of main by: $ahead)"
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: codeling/com_bfstop
           ref: ${{ steps.com.outputs.ref }}
@@ -117,7 +119,7 @@ jobs:
       - name: Move com_bfstop checkout out of the plugin's
         run: mv com_bfstop "$COM_BFSTOP_ROOT"
 
-      - uses: shivammathur/setup-php@v2
+      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: ${{ matrix.php }}
           extensions: mysqli, pdo_mysql, pgsql, pdo_pgsql, zip, mbstring, intl, gd
diff --git a/.github/workflows/dependencies.yml b/.github/workflows/dependencies.yml
index 92f61d8..5c4d057 100644
--- a/.github/workflows/dependencies.yml
+++ b/.github/workflows/dependencies.yml
@@ -18,8 +18,8 @@ jobs:
     name: maxmind-db/reader is current and free of advisories
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: shivammathur/setup-php@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: '8.4'
           coverage: none
diff --git a/tests/README.md b/tests/README.md
index ec8612c..2ce31ff 100644
--- a/tests/README.md
+++ b/tests/README.md
@@ -19,9 +19,11 @@ The classes under test are always loaded from this checkout (and the
 component checkout), not from the copies installed into the Joomla site, so
 the site only needs to be set up again when the database schema changes.
 
-- `lint/`: checks of the language files (`check-language.php`) and of the
-  release zip built by `deploy.sh zip` (`check-zip.php`); both scripts are
-  kept identical in the com_bfstop repository.
+- `lint/`: checks of the language files (`check-language.php`), of the
+  release zip built by `deploy.sh zip` (`check-zip.php`) and of the GitHub
+  Actions workflows (`check-workflows.php`: every action pinned to a commit
+  SHA, with its release in a comment; Dependabot proposes the updates); the
+  scripts are kept identical in the com_bfstop repository.
 - `performance/`: not a test, a comparison of what two versions of the plugin
   (by default 1.5.2 and the checkout) cost a Joomla site, see its README. Not
   run by phpunit or CI.
diff --git a/tests/lint/check-workflows.php b/tests/lint/check-workflows.php
new file mode 100644
index 0000000..92f1877
--- /dev/null
+++ b/tests/lint/check-workflows.php
@@ -0,0 +1,62 @@
+<?php
+/*
+ * @package BFStop Plugin (bfstop) for Joomla!
+ * @author Bernhard Froehler
+ * @copyright (C) Bernhard Froehler
+ * @license GNU/GPLv3 http://www.gnu.org/licenses/gpl-3.0.html
+**/
+// Usage: php tests/lint/check-workflows.php
+//
+// Every action a GitHub Actions workflow uses has to be pinned to the full
+// commit SHA of a release, with the release in a comment:
+//
+//   - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+//
+// A tag like @v7 can be moved by whoever controls the action's repository (or
+// whoever took it over): the next run of our workflows would run what they
+// put there, with this repository's token and in its checkouts. Dependabot
+// (github-actions in .github/dependabot.yml) proposes the updates of pinned
+// actions. Kept identical in the com_bfstop repository.
+//
+// Exits with status 1 if a reference is not pinned.
+
+$root = dirname(__DIR__, 2);
+$files = array_merge(glob($root.'/.github/workflows/*.yml'), glob($root.'/.github/workflows/*.yaml'),
+	glob($root.'/.github/actions/*/action.yml'));
+if (count($files) === 0)
+{
+	fwrite(STDERR, "No workflow files found in $root/.github\n");
+	exit(1);
+}
+$errors = 0;
+$references = 0;
+foreach ($files as $file)
+{
+	foreach (file($file) as $number => $line)
+	{
+		if (!preg_match('/^\s*(?:-\s*)?uses:\s*(\S+)(.*)$/', $line, $m))
+		{
+			continue;
+		}
+		$name = $file;
+		$name = substr($name, strlen($root) + 1).':'.($number + 1);
+		$target = $m[1];
+		if (strpos($target, './') === 0)
+		{
+			continue; // an action of this repository
+		}
+		++$references;
+		if (!preg_match('#^[\w.-]+/[\w./-]+@[0-9a-f]{40}$#', $target))
+		{
+			echo "ERROR: $name: '$target' is not pinned to a commit SHA\n";
+			++$errors;
+		}
+		elseif (!preg_match('/^\s*#\s*v?\d+\.\d+/', $m[2]))
+		{
+			echo "ERROR: $name: '$target' has no comment naming the release (# v1.2.3)\n";
+			++$errors;
+		}
+	}
+}
+echo "$references action reference(s) in ".count($files)." file(s) checked, $errors error(s)\n";
+exit($errors > 0 ? 1 : 0);