diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6f28bbf..b1d7bc2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -44,7 +44,7 @@ jobs:
 
       - name: Merge coverage reports
         if: ${{ always() && matrix.os == 'ubuntu-latest' }}
-        uses: danielpalme/ReportGenerator-GitHub-Action@5
+        uses: danielpalme/ReportGenerator-GitHub-Action@5f3701a41d14548c9b8e575a5c235230e515cbc0 # v5.6.0
         with:
           reports: tests/**/coverage.cobertura.xml
           targetdir: coverage