diff --git a/.github/workflows/conformance.yaml b/.github/workflows/conformance.yaml
index e800a282dc..654e90d736 100644
--- a/.github/workflows/conformance.yaml
+++ b/.github/workflows/conformance.yaml
@@ -585,14 +585,14 @@ jobs:
         id: helm
         uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
       - name: Install crane
-        uses: imjasonh/setup-crane@31b88efe9de28ae0ffa220711af4b60be9435f6e
+        uses: imjasonh/setup-crane@31b88efe9de28ae0ffa220711af4b60be9435f6e # v0.4
       - name: Install Cosign
-        uses: sigstore/cosign-installer@4959ce089c160fddf62f7b42464195ba1a56d382
+        uses: sigstore/cosign-installer@4959ce089c160fddf62f7b42464195ba1a56d382 # v3.6.0
       - name: Install chainsaw
         uses: kyverno/action-install-chainsaw@b2f61a8d0459a65c476ac802514d88e1612b3396 # v0.2.9
       # create cluster
       - name: Create kind cluster and setup Sigstore Scaffolding
-        uses: sigstore/scaffolding/actions/setup@16ae89aa23914c53b22e951b225ff08c34ca35a0
+        uses: sigstore/scaffolding/actions/setup@16ae89aa23914c53b22e951b225ff08c34ca35a0 # v0.7.8
         with:
           version: main
           k8s-version: ${{ matrix.k8s-version }}