diff --git a/.github/workflows/code-style.yml b/.github/workflows/code-style.yml
index 4139ebf..d7aecb0 100644
--- a/.github/workflows/code-style.yml
+++ b/.github/workflows/code-style.yml
@@ -15,7 +15,7 @@ jobs:
                 uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
             -   name: Setup PHP
-                uses: shivammathur/setup-php@73963f5001e335723c998e4a0125ce060083985c # v2
+                uses: shivammathur/setup-php@8872c784b04a1420e81191df5d64fbd59d3d3033 # v2
                 with:
                     php-version: 8.1
                     coverage: none # disable xdebug, pcov
diff --git a/.github/workflows/upstream-check.yml b/.github/workflows/upstream-check.yml
index 2d5d60c..c007a31 100644
--- a/.github/workflows/upstream-check.yml
+++ b/.github/workflows/upstream-check.yml
@@ -37,7 +37,7 @@ jobs:
                     ref: ${{ matrix.branch }}
 
             -   name: Setup PHP
-                uses: shivammathur/setup-php@73963f5001e335723c998e4a0125ce060083985c # v2
+                uses: shivammathur/setup-php@8872c784b04a1420e81191df5d64fbd59d3d3033 # v2
                 with:
                     php-version: ${{ matrix.php }}
                     coverage: none