diff --git a/.github/linters/zizmor.yml b/.github/linters/zizmor.yml
index 9906661761e..dfb40750f0a 100644
--- a/.github/linters/zizmor.yml
+++ b/.github/linters/zizmor.yml
@@ -15,10 +15,4 @@
 # specific language governing permissions and limitations
 # under the License.
 
-rules:
-  unpinned-uses:
-    config:
-      policies:
-        r-lib/actions/check-r-package: any
-        r-lib/actions/setup-r: any
-        r-lib/actions/setup-r-dependencies: any
+rules: {}
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 5b5c73abfd3..4b342434ced 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -75,12 +75,12 @@ jobs:
       - name: Sync doc environment
         run: uv sync --group docs
       - run: sudo apt update
-      - uses: r-lib/actions/setup-r@v2.12.0
+      - uses: r-lib/actions/setup-r@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2.12.0
         with:
           r-version: release
           use-public-rspm: true
       - name: Query R dependencies
-        uses: r-lib/actions/setup-r-dependencies@v2.12.0
+        uses: r-lib/actions/setup-r-dependencies@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2.12.0
         with:
           cache: true
           extra-packages: |
diff --git a/.github/workflows/r.yml b/.github/workflows/r.yml
index d8561da4854..f106c62f4c9 100644
--- a/.github/workflows/r.yml
+++ b/.github/workflows/r.yml
@@ -89,12 +89,12 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
-      - uses: r-lib/actions/setup-r@v2.12.0
+      - uses: r-lib/actions/setup-r@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2.12.0
         with:
           r-version: ${{ matrix.r }}
           use-public-rspm: true
       - name: Query R dependencies
-        uses: r-lib/actions/setup-r-dependencies@v2.12.0
+        uses: r-lib/actions/setup-r-dependencies@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2.12.0
         with:
           cache: true
           extra-packages: |
@@ -102,7 +102,7 @@ jobs:
             any::rcmdcheck
           working-directory: './R'
       - name: Build and check R package
-        uses: r-lib/actions/check-r-package@v2.12.0
+        uses: r-lib/actions/check-r-package@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2.12.0
         with:
           build_args: 'c("--no-build-vignettes", "--no-manual")'
           args: 'c("--no-build-vignettes", "--no-manual", "--no-tests")'