diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
index 2f2e895b..c9e5b6c3 100644
--- a/.github/workflows/publish-pypi.yml
+++ b/.github/workflows/publish-pypi.yml
@@ -47,7 +47,7 @@ jobs:
 
       - name: Resolve latest stagehand/server-v3 release
         id: stagehand-server-release
-        uses: actions/github-script@v6
+        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410  # v6
         with:
           github-token: ${{ secrets.STAGEHAND_SOURCE_TOKEN || github.token }}
           script: |