diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index ca22c2c..4c93246 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -64,7 +64,7 @@ jobs:
       #     --jq '.object.sha' \
       #     | xargs -I{} gh api repos/github/codeql-action/git/tags/{} --jq '.object.sha'
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v3
+        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3
         with:
           # bash isn't a first-class CodeQL language; `actions` is the
           # one that matters here (workflow-injection coverage).