diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index fdf6ace6c1f..2d54c55f18b 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -35,7 +35,7 @@ jobs:
           fetch-depth: 0
       -
         name: Set environment variables
-        uses: actions/github-script@v8
+        uses: actions/github-script@v8.0.0
         env:
           INPUT_GITHUB-REF: ${{ github.ref }}
         with:
diff --git a/.github/workflows/pr-review.yml b/.github/workflows/pr-review.yml
index faa443614c5..557eecb4e93 100644
--- a/.github/workflows/pr-review.yml
+++ b/.github/workflows/pr-review.yml
@@ -28,7 +28,7 @@ jobs:
     steps:
       - name: Check if PR author is Docker org member
         id: membership
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        uses: actions/github-script@450193c5abd4cdb17ba9f3ffcfe8f635c4bb6c2a # v7
         with:
           github-token: ${{ secrets.ORG_MEMBERSHIP_TOKEN }}
           script: |
@@ -144,7 +144,7 @@ jobs:
     steps:
       - name: Check if commenter is Docker org member
         id: membership
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        uses: actions/github-script@450193c5abd4cdb17ba9f3ffcfe8f635c4bb6c2a # v7
         with:
           github-token: ${{ secrets.ORG_MEMBERSHIP_TOKEN }}
           script: |
diff --git a/.github/workflows/validate-upstream.yml b/.github/workflows/validate-upstream.yml
index 25a04a61b89..650fae20dca 100644
--- a/.github/workflows/validate-upstream.yml
+++ b/.github/workflows/validate-upstream.yml
@@ -51,7 +51,7 @@ jobs:
         # that folder. If not, create a placeholder stub file for the data file.
         name: Copy data files
         if: ${{ inputs.data-files-id != '' && inputs.data-files-folder != '' }}
-        uses: actions/github-script@v8
+        uses: actions/github-script@v8.0.0
         with:
           script: |
             const fs = require('fs');