diff --git a/.github/workflows/dependency-automerge.yml b/.github/workflows/dependency-automerge.yml
index 118f859..fffbd4f 100644
--- a/.github/workflows/dependency-automerge.yml
+++ b/.github/workflows/dependency-automerge.yml
@@ -16,7 +16,7 @@ jobs:
       - name: Dependabot metadata
         if: github.event.pull_request.user.login == 'dependabot[bot]'
         id: dependabot-metadata
-        uses: dependabot/fetch-metadata@v2
+        uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"