diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
new file mode 100644
index 0000000..8356e11
--- /dev/null
+++ b/.github/workflows/actions.lock
@@ -0,0 +1,22 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.2'
+workflows:
+    '.github/workflows/ci.yml':
+        - 'actions/checkout@v4.3.1'
+        - 'actions/setup-go@v5.6.0'
+    '.github/workflows/release.yml':
+        - 'actions/checkout@v4.3.1'
+        - 'actions/setup-go@v5.6.0'
+dependencies:
+    'actions/checkout@v4.3.1':
+        ref: 'v4.3.1'
+        commit: 'sha1-34e114876b0b11c390a56381ad16ebd13914f8d5'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/setup-go@v5.6.0':
+        ref: 'v5.6.0'
+        commit: 'sha1-40f1582b2485089dde7abd97c1529aa768e1baff'
+        owner_id: 44036562
+        repo_id: 192624594
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 354e2d1..1620b7b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,3 +1,5 @@
+# This workflow is managed by gh actions-lock.
+
 name: CI
 
 on:
@@ -17,9 +19,9 @@ jobs:
       matrix:
         go-version: ['1.19', '1.22', '1.23']
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.3.1
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v5.6.0
         with:
           go-version: ${{ matrix.go-version }}
           cache-dependency-path: go/go.sum
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 80d7d1e..ecb3606 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,3 +1,5 @@
+# This workflow is managed by gh actions-lock.
+
 name: Release
 
 on:
@@ -31,12 +33,12 @@ jobs:
           echo "::error::Releases must be cut from main (got $GITHUB_REF)."
           exit 1
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.3.1
         with:
           fetch-depth: 0
           fetch-tags: true
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v5.6.0
         with:
           go-version: '1.19'
           cache-dependency-path: go/go.sum