diff --git a/.github/workflows/api-doc.yml b/.github/workflows/api-doc.yml
index 3cc12b75..d6a8f5cf 100644
--- a/.github/workflows/api-doc.yml
+++ b/.github/workflows/api-doc.yml
@@ -28,7 +28,7 @@ jobs:
           permission-pull-requests: write
 
       - name: Setup
-        uses: SAP/ai-sdk-python/.github/actions/setup@main
+        uses: SAP/ai-sdk-python/.github/actions/setup@7c4e0ae0f4c548da7a8fd5a630ba849ec38296c6 # main
         with:
           token: ${{ steps.app-token.outputs.token }}
           ref: ${{ github.ref }}
diff --git a/.github/workflows/bump.yml b/.github/workflows/bump.yml
index 12dea16d..ba3fc287 100644
--- a/.github/workflows/bump.yml
+++ b/.github/workflows/bump.yml
@@ -26,7 +26,7 @@ jobs:
           permission-contents: write
 
       - name: Setup
-        uses: SAP/ai-sdk-python/.github/actions/setup@main
+        uses: SAP/ai-sdk-python/.github/actions/setup@7c4e0ae0f4c548da7a8fd5a630ba849ec38296c6 # main
         with:
           token: ${{ steps.app-token.outputs.token }}
           persist-credentials: true
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3f13b863..46f9f531 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,7 +19,7 @@ jobs:
   checks:
     runs-on: ubuntu-latest
     steps:
-      - uses: SAP/ai-sdk-python/.github/actions/setup@main
+      - uses: SAP/ai-sdk-python/.github/actions/setup@7c4e0ae0f4c548da7a8fd5a630ba849ec38296c6 # main
 
       - name: Run pylint
         run: |
@@ -48,7 +48,7 @@ jobs:
             path: packages/gen/tests
             source: packages/gen/gen_ai_hub
     steps:
-      - uses: SAP/ai-sdk-python/.github/actions/setup@main
+      - uses: SAP/ai-sdk-python/.github/actions/setup@7c4e0ae0f4c548da7a8fd5a630ba849ec38296c6 # main
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -71,7 +71,7 @@ jobs:
     if: |
       github.event_name != 'pull_request'
     steps:
-      - uses: SAP/ai-sdk-python/.github/actions/setup@main
+      - uses: SAP/ai-sdk-python/.github/actions/setup@7c4e0ae0f4c548da7a8fd5a630ba849ec38296c6 # main
 
       - name: Run base integration tests
         env:
@@ -103,7 +103,7 @@ jobs:
     if: |
       github.event_name != 'pull_request'
     steps:
-      - uses: SAP/ai-sdk-python/.github/actions/setup@main
+      - uses: SAP/ai-sdk-python/.github/actions/setup@7c4e0ae0f4c548da7a8fd5a630ba849ec38296c6 # main
 
       - name: Run core integration tests
         env:
@@ -140,7 +140,7 @@ jobs:
     if: |
       github.event_name != 'pull_request'
     steps:
-      - uses: SAP/ai-sdk-python/.github/actions/setup@main
+      - uses: SAP/ai-sdk-python/.github/actions/setup@7c4e0ae0f4c548da7a8fd5a630ba849ec38296c6 # main
 
       - name: Run gen integration tests
         env:
diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml
index d889eb29..dbafb9ea 100644
--- a/.github/workflows/documentation.yml
+++ b/.github/workflows/documentation.yml
@@ -14,7 +14,7 @@ jobs:
 
     steps:
       - name: Setup
-        uses: SAP/ai-sdk-python/.github/actions/setup@main
+        uses: SAP/ai-sdk-python/.github/actions/setup@7c4e0ae0f4c548da7a8fd5a630ba849ec38296c6 # main
         with:
           ref: ${{ github.ref_name }}
 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 80ac0b7f..9afb4410 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -81,7 +81,7 @@ jobs:
           echo "package=${PACKAGE}" >> "$GITHUB_OUTPUT"
 
       - name: Setup
-        uses: SAP/ai-sdk-python/.github/actions/setup@main
+        uses: SAP/ai-sdk-python/.github/actions/setup@7c4e0ae0f4c548da7a8fd5a630ba849ec38296c6 # main
         with:
           ref: ${{ github.event.release.tag_name }}
 
diff --git a/.github/workflows/snapshot-release.yml b/.github/workflows/snapshot-release.yml
index f9fa0df2..10cd1d40 100644
--- a/.github/workflows/snapshot-release.yml
+++ b/.github/workflows/snapshot-release.yml
@@ -16,7 +16,7 @@ jobs:
       contents: read
 
     steps:
-      - uses: SAP/ai-sdk-python/.github/actions/setup@main
+      - uses: SAP/ai-sdk-python/.github/actions/setup@7c4e0ae0f4c548da7a8fd5a630ba849ec38296c6 # main
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/teardown-integration-env.yml b/.github/workflows/teardown-integration-env.yml
index bba9cd5a..26f4118e 100644
--- a/.github/workflows/teardown-integration-env.yml
+++ b/.github/workflows/teardown-integration-env.yml
@@ -12,7 +12,7 @@ jobs:
   teardown:
     runs-on: ubuntu-latest
     steps:
-      - uses: SAP/ai-sdk-python/.github/actions/setup@main
+      - uses: SAP/ai-sdk-python/.github/actions/setup@7c4e0ae0f4c548da7a8fd5a630ba849ec38296c6 # main
 
       - name: Tear down integration test environment
         run: bash scripts/teardown-integration-env.sh