diff --git a/.gitea/workflows/renovate.yaml b/.gitea/workflows/renovate.yaml
index 90678f1..5f2afe5 100644
--- a/.gitea/workflows/renovate.yaml
+++ b/.gitea/workflows/renovate.yaml
@@ -9,9 +9,9 @@ on:
 jobs:
   renovate:
     runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:latest
+    container: ghcr.io/renovatebot/renovate:latest@sha256:278d4926a7dc4677450801b4c1d98c53bfe95ab440ce4044b5f05ca6b1680b5c
     steps:
-      - uses: https://git.kjan.de/actions/checkout@v4
+      - uses: https://git.kjan.de/actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
       - run: renovate
         env:
           RENOVATE_CONFIG_FILE: "config.js" # replace it with your config.js path