diff --git a/.renovaterc.json b/.renovaterc.json
index 086375ff1..87303f4fc 100644
--- a/.renovaterc.json
+++ b/.renovaterc.json
@@ -1,6 +1,7 @@
 {
   "labels": ["dependencies"],
   "extends": [
-    "config:base"
+    "config:base",
+    "helpers:pinGitHubActionDigests"
   ]
 }