diff --git a/.github/workflows/benchmarks.yml b/.github/workflows/benchmarks.yml
index d2321f9de..eeba395d2 100644
--- a/.github/workflows/benchmarks.yml
+++ b/.github/workflows/benchmarks.yml
@@ -24,7 +24,7 @@ jobs:
         uses: "actions/checkout@v3"
 
       - name: "Install PHP"
-        uses: "shivammathur/setup-php@v2"
+        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # v2
         with:
           coverage: "pcov"
           php-version: "${{ matrix.php-version }}"
diff --git a/.github/workflows/coding-standards.yml b/.github/workflows/coding-standards.yml
index abbcb1d17..fb01006ee 100644
--- a/.github/workflows/coding-standards.yml
+++ b/.github/workflows/coding-standards.yml
@@ -24,7 +24,7 @@ jobs:
         uses: "actions/checkout@v3"
 
       - name: "Install PHP"
-        uses: "shivammathur/setup-php@v2"
+        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # v2
         with:
           coverage: "pcov"
           php-version: "${{ matrix.php-version }}"
diff --git a/.github/workflows/demo-scripts.yml b/.github/workflows/demo-scripts.yml
index 90c14c030..524bd9335 100644
--- a/.github/workflows/demo-scripts.yml
+++ b/.github/workflows/demo-scripts.yml
@@ -24,7 +24,7 @@ jobs:
         uses: "actions/checkout@v3"
 
       - name: "Install PHP"
-        uses: "shivammathur/setup-php@v2"
+        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # v2
         with:
           coverage: "pcov"
           php-version: "${{ matrix.php-version }}"
diff --git a/.github/workflows/mutation-tests.yml b/.github/workflows/mutation-tests.yml
index 3004c15af..b740caa18 100644
--- a/.github/workflows/mutation-tests.yml
+++ b/.github/workflows/mutation-tests.yml
@@ -24,7 +24,7 @@ jobs:
         uses: "actions/checkout@v3"
 
       - name: "Install PHP"
-        uses: "shivammathur/setup-php@v2"
+        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # v2
         with:
           coverage: "pcov"
           php-version: "${{ matrix.php-version }}"
diff --git a/.github/workflows/phpunit.yml b/.github/workflows/phpunit.yml
index 996fef19b..3dfe5a2f4 100644
--- a/.github/workflows/phpunit.yml
+++ b/.github/workflows/phpunit.yml
@@ -30,7 +30,7 @@ jobs:
         uses: "actions/checkout@v3"
 
       - name: "Install PHP"
-        uses: "shivammathur/setup-php@v2"
+        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # v2
         with:
           coverage: "pcov"
           php-version: "${{ matrix.php-version }}"
diff --git a/.github/workflows/psalm.yml b/.github/workflows/psalm.yml
index 03bbedd97..66d343f80 100644
--- a/.github/workflows/psalm.yml
+++ b/.github/workflows/psalm.yml
@@ -24,7 +24,7 @@ jobs:
         uses: "actions/checkout@v3"
 
       - name: "Install PHP"
-        uses: "shivammathur/setup-php@v2"
+        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # v2
         with:
           coverage: "pcov"
           php-version: "${{ matrix.php-version }}"