diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c75abfb..780c47b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -39,7 +39,7 @@ jobs:
           VOID_TOKEN: ${{ secrets.VOID_TOKEN }}
           VOID_PROJECT: vp-setup-staging
       - name: Comment on PR
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           script: |
             const marker = '<!-- staging-deploy -->';