diff --git a/.forgejo/workflows/tofu-apply-k8s-wheatley.yaml b/.forgejo/workflows/tofu-apply-k8s-wheatley.yaml
index 0a4074a..3ececfc 100644
--- a/.forgejo/workflows/tofu-apply-k8s-wheatley.yaml
+++ b/.forgejo/workflows/tofu-apply-k8s-wheatley.yaml
@@ -6,6 +6,7 @@ on:
       - main
     paths:
       - pve01.wheatley.in/k8s-wheatley/**
+      - .forgejo/workflows/*-k8s-wheatley.yaml
 
 jobs:
   tofu-apply-k8s-wheatley:
@@ -22,8 +23,8 @@ jobs:
       TF_VAR_proxmox_endpoint: ${{ secrets.PROXMOX_ENDPOINT }}
       TF_VAR_proxmox_api_token: ${{ secrets.PROXMOX_API_TOKEN }}
     steps:
-      - uses: https://github.com/actions/checkout@v4
-      - uses: https://github.com/opentofu/setup-opentofu@v1
+      - uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: https://github.com/opentofu/setup-opentofu@9d84900f3238fab8cd84ce47d658d25dd008be2f # v1
         with:
           tofu_version: 1.11.5
 
diff --git a/.forgejo/workflows/tofu-apply-templates.yaml b/.forgejo/workflows/tofu-apply-templates.yaml
index 8dcc224..fb94da2 100644
--- a/.forgejo/workflows/tofu-apply-templates.yaml
+++ b/.forgejo/workflows/tofu-apply-templates.yaml
@@ -7,6 +7,7 @@ on:
       - main
     paths:
       - pve01.wheatley.in/templates/**
+      - .forgejo/workflows/**-templates.yaml
 
 jobs:
   tofu-apply-templates:
@@ -23,8 +24,8 @@ jobs:
       TF_VAR_proxmox_endpoint: ${{ secrets.PROXMOX_ENDPOINT }}
       TF_VAR_proxmox_api_token: ${{ secrets.PROXMOX_API_TOKEN }}
     steps:
-      - uses: https://github.com/actions/checkout@v4
-      - uses: https://github.com/opentofu/setup-opentofu@v1
+      - uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: https://github.com/opentofu/setup-opentofu@9d84900f3238fab8cd84ce47d658d25dd008be2f # v1
         with:
           tofu_version: 1.11.5
 
diff --git a/.forgejo/workflows/tofu-plan-k8s-wheatley.yaml b/.forgejo/workflows/tofu-plan-k8s-wheatley.yaml
index 895ea76..fd629b8 100644
--- a/.forgejo/workflows/tofu-plan-k8s-wheatley.yaml
+++ b/.forgejo/workflows/tofu-plan-k8s-wheatley.yaml
@@ -7,7 +7,7 @@ on:
       - main
     paths:
       - pve01.wheatley.in/k8s-wheatley/**
-      - .forgejo/workflows/tofu-plan-k8s-wheatley.yaml
+      - .forgejo/workflows/*-k8s-wheatley.yaml
 
 jobs:
   tofu-plan-k8s-wheatley:
@@ -25,8 +25,8 @@ jobs:
       TF_VAR_proxmox_api_token: ${{ secrets.PROXMOX_API_TOKEN }}
       PR_NUMBER: ${{ forge.event.pull_request.number }}
     steps:
-      - uses: https://github.com/actions/checkout@v4
-      - uses: https://github.com/opentofu/setup-opentofu@v1
+      - uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: https://github.com/opentofu/setup-opentofu@9d84900f3238fab8cd84ce47d658d25dd008be2f # v1
         with:
           tofu_version: 1.11.5
 
diff --git a/.forgejo/workflows/tofu-plan-templates.yaml b/.forgejo/workflows/tofu-plan-templates.yaml
index 66b2d65..4ac2aeb 100644
--- a/.forgejo/workflows/tofu-plan-templates.yaml
+++ b/.forgejo/workflows/tofu-plan-templates.yaml
@@ -8,7 +8,7 @@ on:
       - main
     paths:
       - pve01.wheatley.in/templates/**
-      - .forgejo/workflows/tofu-plan-templates.yaml
+      - .forgejo/workflows/**-templates.yaml
 
 jobs:
   tofu-plan-templates:
@@ -26,8 +26,8 @@ jobs:
       TF_VAR_proxmox_api_token: ${{ secrets.PROXMOX_API_TOKEN }}
       PR_NUMBER: ${{ forge.event.pull_request.number }}
     steps:
-      - uses: https://github.com/actions/checkout@v4
-      - uses: https://github.com/opentofu/setup-opentofu@v1
+      - uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: https://github.com/opentofu/setup-opentofu@9d84900f3238fab8cd84ce47d658d25dd008be2f # v1
         with:
           tofu_version: 1.11.5