diff --git a/.github/workflows/auto-publish-dry-run.yml b/.github/workflows/auto-publish-dry-run.yml
index bd2ea3e621..0350c6a97b 100644
--- a/.github/workflows/auto-publish-dry-run.yml
+++ b/.github/workflows/auto-publish-dry-run.yml
@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'google/orbax'
     steps:
-    - uses: etils-actions/pypi-auto-publish@v1
+    - uses: etils-actions/pypi-auto-publish@e3c4b4afc3a5b12a44734da938741995538e8223 # v1
       with:
         pypi-token: skip  # Skips PyPI upload
         # Omitting gh-token skips GitHub release creation
diff --git a/.github/workflows/auto-publish.yml b/.github/workflows/auto-publish.yml
index 3c6d62cb0b..b3b3d30ea4 100644
--- a/.github/workflows/auto-publish.yml
+++ b/.github/workflows/auto-publish.yml
@@ -17,7 +17,7 @@ jobs:
 
     steps:
     # 1. Publish the sub-packages first
-    - uses: etils-actions/pypi-auto-publish@v1
+    - uses: etils-actions/pypi-auto-publish@e3c4b4afc3a5b12a44734da938741995538e8223 # v1
       with:
         pypi-token: ${{ secrets.PYPI_API_TOKEN_OBX_CKPT }}
         gh-token: ${{ secrets.GH_PUBLISH_TOKEN }}
@@ -39,7 +39,7 @@ jobs:
 
     steps:
     # 1. Publish the sub-packages first
-    - uses: etils-actions/pypi-auto-publish@v1
+    - uses: etils-actions/pypi-auto-publish@e3c4b4afc3a5b12a44734da938741995538e8223 # v1
       with:
         # NOTE: Do not use gh-token here, as it would conflict with orbax-checkpoint.
         pypi-token: ${{ secrets.PYPI_API_TOKEN_OBX_EXPT }}