diff --git a/.github/workflows/sync-release-changelog.yml b/.github/workflows/sync-release-changelog.yml
index ed19e20a8f..188d2c04bc 100644
--- a/.github/workflows/sync-release-changelog.yml
+++ b/.github/workflows/sync-release-changelog.yml
@@ -64,14 +64,14 @@ jobs:
       - name: Generate GitHub App token
         if: steps.find-pr.outputs.found == 'true'
         id: app-token
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           client-id: ${{ vars.RELEASE_APP_CLIENT_ID }}
           private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
 
       - name: Check out release PR branch
         if: steps.find-pr.outputs.found == 'true'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ steps.find-pr.outputs.branch }}
           fetch-depth: 0