diff --git a/.github/workflows/bump-asf-reference.yml b/.github/workflows/bump-asf-reference.yml
index d206241..9ada965 100644
--- a/.github/workflows/bump-asf-reference.yml
+++ b/.github/workflows/bump-asf-reference.yml
@@ -35,7 +35,7 @@ jobs:
         type: ${{ env.RELEASE_TYPE }}
 
     - name: Import GPG key for signing
-      uses: crazy-max/ghaction-import-gpg@v5.3.0
+      uses: crazy-max/ghaction-import-gpg@d6f3f49f3345e29369fe57596a3ca8f94c4d2ca7 # v5.4.0
       if: ${{ env.GPG_PRIVATE_KEY != null }}
       with:
         gpg_private_key: ${{ env.GPG_PRIVATE_KEY }}