diff --git a/.github/workflows/api-doc.yml b/.github/workflows/api-doc.yml
index 4fe10cf0..1d5c133b 100644
--- a/.github/workflows/api-doc.yml
+++ b/.github/workflows/api-doc.yml
@@ -28,7 +28,7 @@ jobs:
           permission-pull-requests: write
 
       - name: Setup
-        uses: SAP/ai-sdk-python/.github/actions/setup@main
+        uses: SAP/ai-sdk-python/.github/actions/setup@2342cf3092145d0c5aebbcd1a4e7f3eed8033a66 # main
         with:
           token: ${{ steps.app-token.outputs.token }}
           ref: ${{ github.ref }}
diff --git a/.github/workflows/bump.yml b/.github/workflows/bump.yml
index 4c64386b..0406d4cc 100644
--- a/.github/workflows/bump.yml
+++ b/.github/workflows/bump.yml
@@ -28,7 +28,7 @@ jobs:
           permission-contents: write
 
       - name: Setup
-        uses: SAP/ai-sdk-python/.github/actions/setup@main
+        uses: SAP/ai-sdk-python/.github/actions/setup@2342cf3092145d0c5aebbcd1a4e7f3eed8033a66 # main
         with:
           token: ${{ steps.app-token.outputs.token }}
           persist-credentials: true
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 422a87e8..67d31e40 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,7 +19,7 @@ jobs:
   checks:
     runs-on: ubuntu-latest
     steps:
-      - uses: SAP/ai-sdk-python/.github/actions/setup@main
+      - uses: SAP/ai-sdk-python/.github/actions/setup@2342cf3092145d0c5aebbcd1a4e7f3eed8033a66 # main
 
       - name: Run pylint
         run: |
@@ -48,7 +48,7 @@ jobs:
             path: packages/gen/tests
             source: packages/gen/gen_ai_hub
     steps:
-      - uses: SAP/ai-sdk-python/.github/actions/setup@main
+      - uses: SAP/ai-sdk-python/.github/actions/setup@2342cf3092145d0c5aebbcd1a4e7f3eed8033a66 # main
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -72,7 +72,7 @@ jobs:
       github.event_name != 'pull_request' ||
       github.event.pull_request.head.repo.full_name == github.repository
     steps:
-      - uses: SAP/ai-sdk-python/.github/actions/setup@main
+      - uses: SAP/ai-sdk-python/.github/actions/setup@2342cf3092145d0c5aebbcd1a4e7f3eed8033a66 # main
 
       - name: Run base integration tests
         env:
@@ -105,7 +105,7 @@ jobs:
       github.event_name != 'pull_request' ||
       github.event.pull_request.head.repo.full_name == github.repository
     steps:
-      - uses: SAP/ai-sdk-python/.github/actions/setup@main
+      - uses: SAP/ai-sdk-python/.github/actions/setup@2342cf3092145d0c5aebbcd1a4e7f3eed8033a66 # main
 
       - name: Run core integration tests
         env:
@@ -143,7 +143,7 @@ jobs:
       github.event_name != 'pull_request' ||
       github.event.pull_request.head.repo.full_name == github.repository
     steps:
-      - uses: SAP/ai-sdk-python/.github/actions/setup@main
+      - uses: SAP/ai-sdk-python/.github/actions/setup@2342cf3092145d0c5aebbcd1a4e7f3eed8033a66 # main
 
       - name: Run gen integration tests
         env:
diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml
index 30fee79d..707f86dd 100644
--- a/.github/workflows/documentation.yml
+++ b/.github/workflows/documentation.yml
@@ -14,7 +14,7 @@ jobs:
 
     steps:
       - name: Setup
-        uses: SAP/ai-sdk-python/.github/actions/setup@main
+        uses: SAP/ai-sdk-python/.github/actions/setup@2342cf3092145d0c5aebbcd1a4e7f3eed8033a66 # main
         with:
           ref: ${{ github.ref_name }}
 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 9a3c0fe8..dbf95232 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -81,7 +81,7 @@ jobs:
           echo "package=${PACKAGE}" >> "$GITHUB_OUTPUT"
 
       - name: Setup
-        uses: SAP/ai-sdk-python/.github/actions/setup@main
+        uses: SAP/ai-sdk-python/.github/actions/setup@2342cf3092145d0c5aebbcd1a4e7f3eed8033a66 # main
         with:
           ref: ${{ github.event.release.tag_name }}
 
diff --git a/.github/workflows/snapshot-release.yml b/.github/workflows/snapshot-release.yml
index 10c674e2..ce7661a8 100644
--- a/.github/workflows/snapshot-release.yml
+++ b/.github/workflows/snapshot-release.yml
@@ -16,7 +16,7 @@ jobs:
       contents: read
 
     steps:
-      - uses: SAP/ai-sdk-python/.github/actions/setup@main
+      - uses: SAP/ai-sdk-python/.github/actions/setup@2342cf3092145d0c5aebbcd1a4e7f3eed8033a66 # main
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/teardown-integration-env.yml b/.github/workflows/teardown-integration-env.yml
index bba9cd5a..b31db5b8 100644
--- a/.github/workflows/teardown-integration-env.yml
+++ b/.github/workflows/teardown-integration-env.yml
@@ -12,7 +12,7 @@ jobs:
   teardown:
     runs-on: ubuntu-latest
     steps:
-      - uses: SAP/ai-sdk-python/.github/actions/setup@main
+      - uses: SAP/ai-sdk-python/.github/actions/setup@2342cf3092145d0c5aebbcd1a4e7f3eed8033a66 # main
 
       - name: Tear down integration test environment
         run: bash scripts/teardown-integration-env.sh