diff --git a/.gitea/workflows/golang-linters.yaml b/.gitea/workflows/golang-linters.yaml
index 8d07359..a8d4dfd 100644
--- a/.gitea/workflows/golang-linters.yaml
+++ b/.gitea/workflows/golang-linters.yaml
@@ -21,7 +21,7 @@ jobs:
         os: [ ubuntu-latest-amd64, ubuntu-latest-arm64 ]
     steps:
     - uses: actions/checkout@v6.0.3
-    - uses: actions/setup-go@v6.4.0
+    - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
       with:
         go-version: ${{ matrix.go }}
     - uses: golangci/golangci-lint-action@v9.2.1
diff --git a/.gitea/workflows/golang-tests.yaml b/.gitea/workflows/golang-tests.yaml
index c1cae3b..d728bb3 100644
--- a/.gitea/workflows/golang-tests.yaml
+++ b/.gitea/workflows/golang-tests.yaml
@@ -34,7 +34,7 @@ jobs:
         os: [ ubuntu-latest-amd64, ubuntu-latest-arm64 ]
     steps:
     - uses: actions/checkout@v6.0.3
-    - uses: actions/setup-go@v6.4.0
+    - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
       with:
         go-version: ${{ matrix.go }}
     - env:
diff --git a/.gitea/workflows/release.yaml b/.gitea/workflows/release.yaml
index 39279fd..9f82ed0 100644
--- a/.gitea/workflows/release.yaml
+++ b/.gitea/workflows/release.yaml
@@ -38,7 +38,7 @@ jobs:
       with:
         image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest
     - uses: docker/setup-buildx-action@v4.1.0
-    - uses: actions/setup-go@v6.4.0
+    - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
       with:
         go-version: stable
     - uses: docker/login-action@v4.2.0