diff --git a/action.yml b/action.yml
index 079f109..4638072 100644
--- a/action.yml
+++ b/action.yml
@@ -90,7 +90,7 @@ runs:
     with:
       args: ${{ inputs.extra-args }}
   - name: Upload Kiri custom output
-    uses: actions/upload-artifact@v4
+    uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
     if: inputs.output-dir != '' && github.event_name == 'pull_request' && github.event.action != 'closed' && steps.kicad-files.outputs.changed == 'true'
     with:
       name: kiri-output
@@ -108,7 +108,7 @@ runs:
         echo "output-dir=$(dirname ${{ inputs.project-file }})/.kiri" >> $GITHUB_OUTPUT
       fi
   - name: Upload Kiri output
-    uses: actions/upload-artifact@v4
+    uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
     if: inputs.output-dir == '' && github.event_name == 'pull_request' && github.event.action != 'closed' && steps.kicad-files.outputs.changed == 'true'
     with:
       name: kiri-output