diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 8121c82a9aeff..0e61e580f4a6e 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -61,7 +61,7 @@ jobs:
         run: echo "digest=$(docker inspect --format='{{index .RepoDigests 0}}' brew)" >> "$GITHUB_OUTPUT"
 
       - name: Generate build provenance
-        uses: actions/attest-build-provenance@v1.3.3
+        uses: actions/attest-build-provenance@5e9cb68e95676991667494a6a4e59b8a2f13e1d0 # v1.3.3
         id: attest
         with:
           subject-name: ghcr.io/homebrew/ubuntu${{matrix.version}}
diff --git a/.github/workflows/pkg-installer.yml b/.github/workflows/pkg-installer.yml
index e517243016c59..5261c8f484d37 100644
--- a/.github/workflows/pkg-installer.yml
+++ b/.github/workflows/pkg-installer.yml
@@ -124,7 +124,7 @@ jobs:
           fi
 
       - name: Generate build provenance
-        uses: actions/attest-build-provenance@v1.3.3
+        uses: actions/attest-build-provenance@5e9cb68e95676991667494a6a4e59b8a2f13e1d0 # v1.3.3
         with:
           subject-path: Homebrew-${{ steps.homebrew-version.outputs.version }}.pkg