diff --git a/.github/workflows/upload-db-assets.yml b/.github/workflows/upload-db-assets.yml
index 1ff1397d..e4d54abb 100644
--- a/.github/workflows/upload-db-assets.yml
+++ b/.github/workflows/upload-db-assets.yml
@@ -76,6 +76,6 @@ jobs:
           docker exec postgres sh -c 'export PGPASSWORD=${{ env.DB_PASSWORD }} && pg_dump -Fc -Z 6 -U${{ env.DB_USERNAME }} $DB_DATABASE' > database/dumps/radioroster_${{ github.ref_name }}-postgres${{ inputs.db-version }}.sql.gz
 
       - name: Upload database dump
-        uses: softprops/action-gh-release@v0.1.15
+        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v0.1.15
         with:
           files: database/dumps/radioroster_${{ github.ref_name }}${{ inputs.db-type == 'mysql' && '-mariadb' || inputs.db-type == 'pgsql' && '-postgres' }}${{ inputs.db-version }}.sql.gz
diff --git a/.github/workflows/upload-file-assets.yml b/.github/workflows/upload-file-assets.yml
index d89f8740..46955cf1 100644
--- a/.github/workflows/upload-file-assets.yml
+++ b/.github/workflows/upload-file-assets.yml
@@ -36,6 +36,6 @@ jobs:
         run: zip -r -q -9 -X radioroster_${{ github.ref_name }}-php${{ matrix.php-versions }}.zip .
 
       - name: Upload zip file as asset
-        uses: softprops/action-gh-release@v0.1.15
+        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v0.1.15
         with:
           files: radioroster_${{ github.ref_name }}-php${{ matrix.php-versions }}.zip