diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml
index c7e2092..6a779d3 100644
--- a/.github/workflows/renovate.yaml
+++ b/.github/workflows/renovate.yaml
@@ -70,7 +70,7 @@ jobs:
             ${{ !contains('["issues", "pull_request"]', github.event_name) && github.ref_name == 'main' || contains(github.ref_name, 'renovate/') }}
           dry_run: ${{ github.event_name == 'push' && github.ref_name != 'main' }}
         if: github.event_name != 'push' || steps.filter.outputs.changes == 'true'
-        uses: bfra-me/renovate-action@v4
+        uses: bfra-me/renovate-action@6698751cecd801c8132b98876b285edd04ae6ac0 # v4.3.3
         with:
           branch: ${{ env.dry_run == 'true' && github.ref_name || '' }}
           cache: ${{ env.cache }}