diff --git a/.github/workflows/build-rust-injector.yml b/.github/workflows/build-rust-injector.yml
index 9c12488113..77d939f6f7 100644
--- a/.github/workflows/build-rust-injector.yml
+++ b/.github/workflows/build-rust-injector.yml
@@ -33,7 +33,7 @@ jobs:
           shasum zarf-injector-arm64 >> checksums.txt
 
       - name: Auth with AWS
-        uses: aws-actions/configure-aws-credentials@v3
+        uses: aws-actions/configure-aws-credentials@010d0da01d0b5a38af31e9c3470dbfdabdecca3a # v4.0.1
         with:
           role-to-assume: ${{ secrets.AWS_WRITE_ROLE }}
           role-session-name: ${{ github.job || github.event.client_payload.pull_request.head.sha || github.sha }}