diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
index ebca86ea..b5af6b0a 100644
--- a/.github/workflows/CI.yml
+++ b/.github/workflows/CI.yml
@@ -55,6 +55,6 @@ jobs:
 
       - name: Publish to PyPI using Trusted Publishing
         # Note: No pypi_token / username / password provided — Trusted Publishing via OIDC is used.
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e  # release/v1.13
         with:
           attestations: true # optional (default for Trusted Publishing) - set to false to disable