diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 97c14cc..5e88946 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -42,7 +42,7 @@ jobs:
           tar -czf reports/build.tar.gz build
   
       # Upload artifacts so they are shared with the chainloop job
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
         with:
           name: reports
           path: reports/*
@@ -52,9 +52,9 @@ jobs:
       NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }}
       NETLIFY_SITE_ID: ${{ secrets.NETLIFY_SITE_ID }}
 
-  # Attest the uploaded artifacts listed in //.chainloop.yaml
+  # Attest the uploaded artifacts listed in .chainloop.yaml
   chainloop:
-    uses: chainloop-dev/labs/.github/workflows/chainloop.yml@main
+    uses: chainloop-dev/labs/.github/workflows/chainloop.yml@22771db0eec9be335d9dd5f1f9741f6dd65a5239
     needs: deploy
     secrets:
       api_token: ${{ secrets.CHAINLOOP_WF_RELEASE }}