diff --git a/.github/workflows/e2e-test.yaml b/.github/workflows/e2e-test.yaml
index c4419196..3b4fc0f9 100644
--- a/.github/workflows/e2e-test.yaml
+++ b/.github/workflows/e2e-test.yaml
@@ -23,7 +23,7 @@ jobs:
         run: |
           make print-go-version >> "$GITHUB_OUTPUT"
 
-      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6
+      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
         with:
           go-version: ${{ steps.go-version.outputs.result }}
 
diff --git a/modules/repository-base/base/.github/workflows/renovate.yaml b/modules/repository-base/base/.github/workflows/renovate.yaml
index cf98c1b1..62b54e6a 100644
--- a/modules/repository-base/base/.github/workflows/renovate.yaml
+++ b/modules/repository-base/base/.github/workflows/renovate.yaml
@@ -27,7 +27,7 @@ jobs:
           exit 1
 
       - name: Octo STS Token Exchange
-        uses: octo-sts/action@e480437973a6f6ac2e9caa40ecabedc870d76395 # main
+        uses: octo-sts/action@e480437973a6f6ac2e9caa40ecabedc870d76395 # v1.0.1
         id: octo-sts
         with:
           scope: '{{REPLACE:GH-REPOSITORY}}'