diff --git a/.github/workflows/setup-repository.yml b/.github/workflows/setup-repository.yml
index 1c8e458..e534e4f 100644
--- a/.github/workflows/setup-repository.yml
+++ b/.github/workflows/setup-repository.yml
@@ -11,7 +11,7 @@ jobs:
     steps:
       - name: Check if repo is a template repository
         id: checkRepo
-        uses: actions/github-script@v6
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           script: |
             const repo = await github.rest.repos.get({
@@ -48,7 +48,7 @@ jobs:
       - uses: actions/checkout@v3
 
       - name: Create cookiecutter.json
-        uses: actions/github-script@v6
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           script: |
             const config = { name: context.repo.repo };