diff --git a/.github/workflows/tests-mysql.yml b/.github/workflows/tests-mysql.yml
index c255955901..e0ec622300 100644
--- a/.github/workflows/tests-mysql.yml
+++ b/.github/workflows/tests-mysql.yml
@@ -33,7 +33,7 @@ jobs:
     name: PHP ${{ matrix.php-version }}
 
     steps:
-      - uses: shivammathur/setup-php@v2
+      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2.37.2
         with:
           php-version: "${{ matrix.php-version }}"
           coverage: none
diff --git a/.github/workflows/tests-postgres.yml b/.github/workflows/tests-postgres.yml
index 5dc8216135..3cea57d65e 100644
--- a/.github/workflows/tests-postgres.yml
+++ b/.github/workflows/tests-postgres.yml
@@ -30,7 +30,7 @@ jobs:
     name: PHP ${{ matrix.php-version }}
 
     steps:
-      - uses: shivammathur/setup-php@v2
+      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2.37.2
         with:
           php-version: "${{ matrix.php-version }}"
           coverage: none
diff --git a/.github/workflows/tests-sqlite.yml b/.github/workflows/tests-sqlite.yml
index 6475ff6f32..4ab665f9c8 100644
--- a/.github/workflows/tests-sqlite.yml
+++ b/.github/workflows/tests-sqlite.yml
@@ -20,7 +20,7 @@ jobs:
     name: PHP ${{ matrix.php-version }}
 
     steps:
-      - uses: shivammathur/setup-php@v2
+      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2.37.2
         with:
           php-version: "${{ matrix.php-version }}"
           coverage: none