diff --git a/.github/workflows/acceptance-tests.yml b/.github/workflows/acceptance-tests.yml
index 08694e7f031..32fa6e50450 100644
--- a/.github/workflows/acceptance-tests.yml
+++ b/.github/workflows/acceptance-tests.yml
@@ -5,8 +5,26 @@ on:
   workflow_dispatch:
 
 jobs:
+  build-and-test:
+    name: build-and-test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Build ocis
+        run: make -C ocis build
+
+      - name: Unit tests
+        run: make test
+
   acceptance-tests:
     name: ${{ matrix.suite }}
+    needs: [build-and-test]
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -40,14 +58,14 @@ jobs:
           - apiSharingNgLinkShareManagement
           
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version-file: go.mod
           cache: true
 
-      - uses: shivammathur/setup-php@v2
+      - uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0
         with:
           php-version: "8.4"
           extensions: curl, xml, mbstring, zip
@@ -58,13 +76,13 @@ jobs:
 
       - name: Upload test logs
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: test-logs-${{ matrix.suite }}
           path: tests/acceptance/output/
 
   all-acceptance-tests:
-    needs: [acceptance-tests]
+    needs: [build-and-test, acceptance-tests]
     runs-on: ubuntu-latest
     if: always()
     steps: