diff --git a/.gitea/workflows/renovate.yaml b/.gitea/workflows/renovate.yaml
index 1f3b251..2337e36 100644
--- a/.gitea/workflows/renovate.yaml
+++ b/.gitea/workflows/renovate.yaml
@@ -10,9 +10,9 @@ on:
 jobs:
   renovate:
     runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:latest
+    container: ghcr.io/renovatebot/renovate:latest@sha256:4de20ad59149f923324960791d0bf7a5251b7a0f992f3bde6ab78c55c1522351
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
       - run: renovate
         env:
           RENOVATE_CONFIG_FILE: "/workspace/renovate-bot/renovate-config/config.js"