diff --git a/.github/workflows/publish-safe-outputs-node.yml b/.github/workflows/publish-safe-outputs-node.yml
index e391010fb1a..5dcd263ca31 100644
--- a/.github/workflows/publish-safe-outputs-node.yml
+++ b/.github/workflows/publish-safe-outputs-node.yml
@@ -190,7 +190,7 @@ jobs:
 
       - name: Build and push gh-aw-node
         if: steps.decision.outputs.should_push == 'true'
-        uses: docker/build-push-action@v7.2.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           file: actions/setup/js/Dockerfile.safe-outputs-mcp