diff --git a/.github/actions/checkout-as-app/action.yml b/.github/actions/checkout-as-app/action.yml
index dcd77de..eefed83 100644
--- a/.github/actions/checkout-as-app/action.yml
+++ b/.github/actions/checkout-as-app/action.yml
@@ -133,7 +133,7 @@ runs:
     # ── Step 1: Authenticate as GitHub App (skip its built-in checkout) ──
     - name: Authenticate as GitHub App
       id: auth
-      uses: nsheaps/github-actions/.github/actions/github-app-auth@main
+      uses: nsheaps/github-actions/.github/actions/github-app-auth@1e129396b6f0b39257efac9a255010fe64a68ef8 # main
       with:
         app-id: ${{ inputs.app-id }}
         private-key: ${{ inputs.private-key }}
diff --git a/.github/workflows/sync-plugin-specs.yaml b/.github/workflows/sync-plugin-specs.yaml
index 4553029..79fe65b 100644
--- a/.github/workflows/sync-plugin-specs.yaml
+++ b/.github/workflows/sync-plugin-specs.yaml
@@ -26,7 +26,7 @@ jobs:
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: nsheaps/github-actions/.github/actions/sync-plugin-specs@main
+      - uses: nsheaps/github-actions/.github/actions/sync-plugin-specs@1e129396b6f0b39257efac9a255010fe64a68ef8 # main
         with:
           plugins-dir: ${{ inputs.plugins-dir || 'plugins' }}
           commit: 'true'