diff --git a/.github/workflows/post-commit.yml b/.github/workflows/post-commit.yml
index ee7b384..f29df39 100644
--- a/.github/workflows/post-commit.yml
+++ b/.github/workflows/post-commit.yml
@@ -55,7 +55,7 @@ jobs:
                   [ -z "$(cat ${{ env.ARTIFACT }})" ] && RESULT=false || RESULT=true
                   echo "patch_not_empty=$RESULT" >> "$GITHUB_OUTPUT"
             - name: upload
-              uses: actions/upload-artifact@v4
+              uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
               with:
                   name: ${{ env.ARTIFACT }}
                   path: ${{ env.ARTIFACT }}
@@ -76,7 +76,7 @@ jobs:
               run: |
                   gh pr checkout ${{ inputs.pr_number }}
             - name: download-patch
-              uses: actions/download-artifact@v4
+              uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
               with:
                   name: ${{ env.ARTIFACT }}
             - id: apply