diff --git a/templates/repository/server/.github/workflows/cve-scan.yaml b/templates/repository/server/.github/workflows/cve-scan.yaml
index 7853390..9dc931c 100644
--- a/templates/repository/server/.github/workflows/cve-scan.yaml
+++ b/templates/repository/server/.github/workflows/cve-scan.yaml
@@ -82,7 +82,7 @@ jobs:
         with:
           sarif_file: ${{ steps.grype-scan.outputs.sarif }}
       - name: Kubescape scanner
-        uses: kubescape/github-action@main
+        uses: kubescape/github-action@7d90c1f159f02df1e3c79f839eeabe42ea30d4e3 # pins @main as of 2026-06-01
         id: kubescape
         with:
           image: ${{ env.IMAGE_NAME }}