diff --git a/.gitea/workflows/pr-docker-deploy.yml b/.gitea/workflows/pr-docker-deploy.yml
index 880a5e8..22c8a77 100644
--- a/.gitea/workflows/pr-docker-deploy.yml
+++ b/.gitea/workflows/pr-docker-deploy.yml
@@ -192,7 +192,7 @@ jobs:
       #     docker login -u gitea-sonarqube-bot -p ${REGISTRY_PASSWORD} git.trez.wtf
 
       - name: Login to registries
-        uses: docker/login-action@v3
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3
         with:
           registry-auth: |
             - username: ${{ secrets.DOCKERHUB_USER }}
@@ -339,7 +339,7 @@ jobs:
       #     docker login -u gitea-sonarqube-bot -p ${REGISTRY_PASSWORD} git.trez.wtf
 
       - name: Login to registries
-        uses: docker/login-action@v3
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3
         with:
           registry-auth: |
             - username: ${{ secrets.DOCKERHUB_USER }}
diff --git a/.gitea/workflows/renovate-pr-deploy.yml b/.gitea/workflows/renovate-pr-deploy.yml
index a24bb6d..70c1efa 100644
--- a/.gitea/workflows/renovate-pr-deploy.yml
+++ b/.gitea/workflows/renovate-pr-deploy.yml
@@ -144,7 +144,7 @@ jobs:
           vault kv get -format=json benedikta-docker/env | jq -r '.data.data' | jq -r 'keys[] as $k | "\($k)='\''\(.[$k])'\''"' > .env
 
       - name: Login to registries
-        uses: docker/login-action@v3
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3
         with:
           registry-auth: |
             - username: ${{ secrets.DOCKERHUB_USER }}