diff --git a/.renovaterc.json b/.renovaterc.json
index 22530b42ec..bdeec3e80c 100644
--- a/.renovaterc.json
+++ b/.renovaterc.json
@@ -1,5 +1,8 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "helpers:pinGitHubActionDigests"
+  ],
   "packageRules": [
     {
       "matchPackagePatterns": [