diff --git a/.github/workflows/njsscan.yml b/.github/workflows/njsscan.yml
index 3b2f0dc0ab..6a9581c5ce 100644
--- a/.github/workflows/njsscan.yml
+++ b/.github/workflows/njsscan.yml
@@ -37,6 +37,6 @@ jobs:
       with:
         args: '. --sarif --output results.sarif || true'
     - name: Upload njsscan report
-      uses: github/codeql-action/upload-sarif@v2
+      uses: github/codeql-action/upload-sarif@e5f05b81d5b6ff8cfa111c80c22c5fd02a384118 # v3
       with:
         sarif_file: results.sarif