diff --git a/.github/workflows/bootstrap.yaml b/.github/workflows/bootstrap.yaml
index 61f423e..2a80a03 100644
--- a/.github/workflows/bootstrap.yaml
+++ b/.github/workflows/bootstrap.yaml
@@ -41,7 +41,7 @@ jobs:
 
       # This will only work, if you've run `npx cdk deploy` once manually.
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
         with:
           # The role is set up via https://github.com/bifravst/ci
           # secrets.AWS_ACCOUNT_ID_CI is an organization secret
diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index 71c5944..73fe922 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -34,7 +34,7 @@ jobs:
 
       # This will only work, if you've run `npx cdk deploy` once manually.
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
         with:
           # The role is set up via https://github.com/bifravst/ci
           # secrets.AWS_ACCOUNT_ID_CI is an organization secret