diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 202ef890a..218b3255b 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -474,7 +474,7 @@ jobs:
         path: out
 
     - name: Import GPG key for signing
-      uses: crazy-max/ghaction-import-gpg@v5.3.0
+      uses: crazy-max/ghaction-import-gpg@d6f3f49f3345e29369fe57596a3ca8f94c4d2ca7 # v5.4.0
       with:
         gpg_private_key: ${{ secrets.ARCHIBOT_GPG_PRIVATE_KEY }}
 
diff --git a/.github/workflows/translations.yml b/.github/workflows/translations.yml
index d1bab7144..1cf20952d 100644
--- a/.github/workflows/translations.yml
+++ b/.github/workflows/translations.yml
@@ -38,7 +38,7 @@ jobs:
         token: ${{ secrets.ASF_CROWDIN_API_TOKEN }}
 
     - name: Import GPG key for signing
-      uses: crazy-max/ghaction-import-gpg@v5.3.0
+      uses: crazy-max/ghaction-import-gpg@d6f3f49f3345e29369fe57596a3ca8f94c4d2ca7 # v5.4.0
       with:
         gpg_private_key: ${{ secrets.ARCHIBOT_GPG_PRIVATE_KEY }}
         git_config_global: true