diff --git a/.github/workflows/prerelease.yml b/.github/workflows/prerelease.yml
index e468e76..22ecf8a 100644
--- a/.github/workflows/prerelease.yml
+++ b/.github/workflows/prerelease.yml
@@ -16,9 +16,9 @@ jobs:
         with:
           go-version: '1.21.x'
       - name: Goreleaser publish
-        uses: goreleaser/goreleaser-action@v1
+        uses: goreleaser/goreleaser-action@5742e2a039330cbb23ebf35f046f814d4c6ff811 # v5.1.0
         with:
-          version: latest
+          version: v1.26.2
           args: release --rm-dist --config=.goreleaser.prelease.yml
         env:
           GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0a37604..dc7b7b7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,9 +16,9 @@ jobs:
         with:
           go-version: '1.21.x'
       - name: Goreleaser publish
-        uses: goreleaser/goreleaser-action@v1
+        uses: goreleaser/goreleaser-action@5742e2a039330cbb23ebf35f046f814d4c6ff811 # v5.1.0
         with:
-          version: latest
+          version: v1.26.2
           args: release --rm-dist
         env:
           GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}