diff --git a/.github/workflows/prow-action.yml b/.github/workflows/prow-action.yml
index 871f69f8f..8a9190180 100644
--- a/.github/workflows/prow-action.yml
+++ b/.github/workflows/prow-action.yml
@@ -14,7 +14,7 @@ jobs:
     if: github.repository == 'velero-io/velero'
     runs-on: ubuntu-latest
     steps:
-      - uses: jpmcb/prow-github-actions@v1.1.3
+      - uses: jpmcb/prow-github-actions@f4d01dd4b13f289014c23fe5a19878a2479cb35b # v1.1.3
         with:
           # TODO: before allowing the /lgtm command, see if we can block merging if changelog labels are missing.
           prow-commands: |