diff --git a/.github/workflows/cerberus-integration.yml b/.github/workflows/cerberus-integration.yml
index 0b918cf6..bee7d7cc 100644
--- a/.github/workflows/cerberus-integration.yml
+++ b/.github/workflows/cerberus-integration.yml
@@ -156,7 +156,7 @@ jobs:
       # Try registry first (fast), fallback to artifact if registry fails
       - name: Pull Docker image from registry
         id: pull_image
-        uses: nick-fields/retry@v3
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3
         with:
           timeout_minutes: 5
           max_attempts: 3
diff --git a/.github/workflows/crowdsec-integration.yml b/.github/workflows/crowdsec-integration.yml
index 5f972903..aa806f67 100644
--- a/.github/workflows/crowdsec-integration.yml
+++ b/.github/workflows/crowdsec-integration.yml
@@ -100,7 +100,7 @@ jobs:
       # Try registry first (fast), fallback to artifact if registry fails
       - name: Pull Docker image from registry
         id: pull_image
-        uses: nick-fields/retry@v3
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3
         with:
           timeout_minutes: 5
           max_attempts: 3
diff --git a/.github/workflows/e2e-tests.yml b/.github/workflows/e2e-tests.yml
index e4f13c07..fdcbd8db 100644
--- a/.github/workflows/e2e-tests.yml
+++ b/.github/workflows/e2e-tests.yml
@@ -167,7 +167,7 @@ jobs:
       # Try registry first (fast), fallback to artifact if registry fails
       - name: Pull Docker image from registry
         id: pull_image
-        uses: nick-fields/retry@v3
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3
         with:
           timeout_minutes: 5
           max_attempts: 3
diff --git a/.github/workflows/rate-limit-integration.yml b/.github/workflows/rate-limit-integration.yml
index 5e309250..1d938c88 100644
--- a/.github/workflows/rate-limit-integration.yml
+++ b/.github/workflows/rate-limit-integration.yml
@@ -156,7 +156,7 @@ jobs:
       # Try registry first (fast), fallback to artifact if registry fails
       - name: Pull Docker image from registry
         id: pull_image
-        uses: nick-fields/retry@v3
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3
         with:
           timeout_minutes: 5
           max_attempts: 3
diff --git a/.github/workflows/waf-integration.yml b/.github/workflows/waf-integration.yml
index 0190b9ca..6344ef04 100644
--- a/.github/workflows/waf-integration.yml
+++ b/.github/workflows/waf-integration.yml
@@ -156,7 +156,7 @@ jobs:
       # Try registry first (fast), fallback to artifact if registry fails
       - name: Pull Docker image from registry
         id: pull_image
-        uses: nick-fields/retry@v3
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3
         with:
           timeout_minutes: 5
           max_attempts: 3