diff --git a/.github/renovate.json b/.github/renovate.json
index cd6cb463785..eb2262530b4 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -1,6 +1,7 @@
 {
   "extends": [
-    "config:base"
+    "config:base",
+    "helpers:pinGitHubActionDigests"
   ],
   "labels": ["type: dependency upgrade"],
   "packageRules": [