diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index 5fd97f46d7c..9fa9fe2b668 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -91,7 +91,7 @@ jobs:
     steps:
       - name: Get app token
         id: app-token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349  # v2
         with:
           app-id: ${{ secrets.IGNITEUI_GITHUB_APP_ID }}
           private-key: ${{ secrets.IGNITEUI_GITHUB_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/trigger-licensed-release.yml b/.github/workflows/trigger-licensed-release.yml
index 56a9e109c1d..cd2ff758b59 100644
--- a/.github/workflows/trigger-licensed-release.yml
+++ b/.github/workflows/trigger-licensed-release.yml
@@ -20,7 +20,7 @@ jobs:
     steps:
       - name: Get app token
         id: app-token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349  # v2
         with:
           app-id: ${{ secrets.IGNITEUI_GITHUB_APP_ID }}
           private-key: ${{ secrets.IGNITEUI_GITHUB_APP_PRIVATE_KEY }}