diff --git a/.gitea/workflows/helm.yaml b/.gitea/workflows/helm.yaml
index e441e2a..4ebe885 100644
--- a/.gitea/workflows/helm.yaml
+++ b/.gitea/workflows/helm.yaml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v6.0.3
-    - uses: azure/setup-helm@v5.0.0
+    - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
       with:
         version: v4.2.2 # renovate: datasource=github-releases depName=helm/helm
     - name: Lint helm files
@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v6.0.3
-    - uses: azure/setup-helm@v5.0.0
+    - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
       with:
         version: v4.2.2 # renovate: datasource=github-releases depName=helm/helm
     - env:
diff --git a/.gitea/workflows/release.yaml b/.gitea/workflows/release.yaml
index e628eda..7e4fc30 100644
--- a/.gitea/workflows/release.yaml
+++ b/.gitea/workflows/release.yaml
@@ -18,7 +18,7 @@ jobs:
         with:
           cosign-release: "v3.1.1" # renovate: datasource=github-tags depName=sigstore/cosign
 
-      - uses: azure/setup-helm@v5.0.0
+      - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
         with:
           version: "v4.2.2" # renovate: datasource=github-tags depName=helm/helm