diff --git a/.github/workflows/pre-commit-update.yml b/.github/workflows/pre-commit-update.yml
index de8d1dc..648908e 100644
--- a/.github/workflows/pre-commit-update.yml
+++ b/.github/workflows/pre-commit-update.yml
@@ -24,7 +24,7 @@ jobs:
           python-version: '3.14'
 
       - name: Install Hatch
-        uses: pypa/hatch@install
+        uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc # install
         with:
           version: "${{ env.HATCH_VERSION }}"
 
diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml
index 61f119a..4f1ac7c 100644
--- a/.github/workflows/python-publish.yml
+++ b/.github/workflows/python-publish.yml
@@ -25,7 +25,7 @@ jobs:
           python-version: "3.14"
 
       - name: Install Hatch
-        uses: pypa/hatch@install
+        uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc # install
         with:
           version: "${{ env.HATCH_VERSION }}"
 
diff --git a/.github/workflows/python-tests.yml b/.github/workflows/python-tests.yml
index 34a9452..a0a2604 100644
--- a/.github/workflows/python-tests.yml
+++ b/.github/workflows/python-tests.yml
@@ -42,7 +42,7 @@ jobs:
         cache: "pip"
 
     - name: Install Hatch
-      uses: pypa/hatch@install
+      uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc # install
       with:
         version: "${{ env.HATCH_VERSION }}"