diff --git a/.github/workflows/benchmarks.yml b/.github/workflows/benchmarks.yml
index d2321f9d..36c5d42a 100644
--- a/.github/workflows/benchmarks.yml
+++ b/.github/workflows/benchmarks.yml
@@ -24,7 +24,7 @@ jobs:
         uses: "actions/checkout@v3"
 
       - name: "Install PHP"
-        uses: "shivammathur/setup-php@v2"
+        uses: "shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240" # v2
         with:
           coverage: "pcov"
           php-version: "${{ matrix.php-version }}"
diff --git a/.github/workflows/coding-standards.yml b/.github/workflows/coding-standards.yml
index abbcb1d1..9b7e6dce 100644
--- a/.github/workflows/coding-standards.yml
+++ b/.github/workflows/coding-standards.yml
@@ -24,7 +24,7 @@ jobs:
         uses: "actions/checkout@v3"
 
       - name: "Install PHP"
-        uses: "shivammathur/setup-php@v2"
+        uses: "shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240" # v2
         with:
           coverage: "pcov"
           php-version: "${{ matrix.php-version }}"
diff --git a/.github/workflows/demo-scripts.yml b/.github/workflows/demo-scripts.yml
index 90c14c03..3610e1c1 100644
--- a/.github/workflows/demo-scripts.yml
+++ b/.github/workflows/demo-scripts.yml
@@ -24,7 +24,7 @@ jobs:
         uses: "actions/checkout@v3"
 
       - name: "Install PHP"
-        uses: "shivammathur/setup-php@v2"
+        uses: "shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240" # v2
         with:
           coverage: "pcov"
           php-version: "${{ matrix.php-version }}"
diff --git a/.github/workflows/mutation-tests.yml b/.github/workflows/mutation-tests.yml
index 3004c15a..9783caff 100644
--- a/.github/workflows/mutation-tests.yml
+++ b/.github/workflows/mutation-tests.yml
@@ -24,7 +24,7 @@ jobs:
         uses: "actions/checkout@v3"
 
       - name: "Install PHP"
-        uses: "shivammathur/setup-php@v2"
+        uses: "shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240" # v2
         with:
           coverage: "pcov"
           php-version: "${{ matrix.php-version }}"
diff --git a/.github/workflows/phpunit.yml b/.github/workflows/phpunit.yml
index 996fef19..c7f02101 100644
--- a/.github/workflows/phpunit.yml
+++ b/.github/workflows/phpunit.yml
@@ -30,7 +30,7 @@ jobs:
         uses: "actions/checkout@v3"
 
       - name: "Install PHP"
-        uses: "shivammathur/setup-php@v2"
+        uses: "shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240" # v2
         with:
           coverage: "pcov"
           php-version: "${{ matrix.php-version }}"
diff --git a/.github/workflows/psalm.yml b/.github/workflows/psalm.yml
index 03bbedd9..ccc806cf 100644
--- a/.github/workflows/psalm.yml
+++ b/.github/workflows/psalm.yml
@@ -24,7 +24,7 @@ jobs:
         uses: "actions/checkout@v3"
 
       - name: "Install PHP"
-        uses: "shivammathur/setup-php@v2"
+        uses: "shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240" # v2
         with:
           coverage: "pcov"
           php-version: "${{ matrix.php-version }}"