diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
index 9f99e6301..5f3838f42 100644
--- a/.github/workflows/integration-tests.yml
+++ b/.github/workflows/integration-tests.yml
@@ -323,7 +323,7 @@ jobs:
       id-token: write
     steps:
       - id: get-secrets
-        uses: grafana/shared-workflows/actions/get-vault-secrets@get-vault-secrets/v1.3.0 # zizmor: ignore[unpinned-uses] provided by grafana
+        uses: grafana/shared-workflows/actions/get-vault-secrets@a37de51f3d713a30a9e4b21bcdfbd38170020593 # get-vault-secrets/v1.3.0 # zizmor: ignore[unpinned-uses] provided by grafana
         with:
           export_env: false
           # Secrets placed in the ci/repo/grafana/grafana-plugin-examples path in Vault
diff --git a/.github/workflows/notify-plugin-tools.yml b/.github/workflows/notify-plugin-tools.yml
index cca999f39..a5a7089bf 100644
--- a/.github/workflows/notify-plugin-tools.yml
+++ b/.github/workflows/notify-plugin-tools.yml
@@ -35,7 +35,7 @@ jobs:
           COMMIT_SHA: ${{ github.event.pull_request.merge_commit_sha }}
 
       - id: get-secrets
-        uses: grafana/shared-workflows/actions/get-vault-secrets@get-vault-secrets/v1.3.0 # zizmor: ignore[unpinned-uses] provided by grafana
+        uses: grafana/shared-workflows/actions/get-vault-secrets@a37de51f3d713a30a9e4b21bcdfbd38170020593 # get-vault-secrets/v1.3.0 # zizmor: ignore[unpinned-uses] provided by grafana
         with:
           export_env: false
           # Secrets placed in the ci/repo/grafana/grafana-plugin-examples path in Vault