diff --git a/.forgejo/workflows/renovate.yml b/.forgejo/workflows/renovate.yml
index cbb9a1f..733facc 100644
--- a/.forgejo/workflows/renovate.yml
+++ b/.forgejo/workflows/renovate.yml
@@ -12,10 +12,10 @@ jobs:
   renovate:
     name: Run
     runs-on: docker
-    container: ghcr.io/renovatebot/renovate:39.83.3
+    container: ghcr.io/renovatebot/renovate:39.83.3@sha256:f31ab26bd04c3bc384b77b99c7366577bb593acacd15584eec41f91c81666b41
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - name: Run Renovate
         run: renovate
         env: