diff --git a/.github/actions/checkout-as-app/action.yml b/.github/actions/checkout-as-app/action.yml
index dcd77de..7c37ef7 100644
--- a/.github/actions/checkout-as-app/action.yml
+++ b/.github/actions/checkout-as-app/action.yml
@@ -133,7 +133,7 @@ runs:
     # ── Step 1: Authenticate as GitHub App (skip its built-in checkout) ──
     - name: Authenticate as GitHub App
       id: auth
-      uses: nsheaps/github-actions/.github/actions/github-app-auth@main
+      uses: nsheaps/github-actions/.github/actions/github-app-auth@c1794f6f4fbb3cbc5e5a71e820581a74239f706a # main
       with:
         app-id: ${{ inputs.app-id }}
         private-key: ${{ inputs.private-key }}
diff --git a/.github/workflows/sync-plugin-specs.yaml b/.github/workflows/sync-plugin-specs.yaml
index 539b892..a60a580 100644
--- a/.github/workflows/sync-plugin-specs.yaml
+++ b/.github/workflows/sync-plugin-specs.yaml
@@ -38,7 +38,7 @@ jobs:
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: nsheaps/github-actions/.github/actions/sync-plugin-specs@main
+      - uses: nsheaps/github-actions/.github/actions/sync-plugin-specs@c1794f6f4fbb3cbc5e5a71e820581a74239f706a # main
         with:
           plugins-dir: ${{ inputs.plugins-dir || 'plugins' }}
           commit: 'true'