diff --git a/tf/deployment/modules/shared/github/org/repo-files/.github/workflows/org-pr-require-conventional-commit.yml b/tf/deployment/modules/shared/github/org/repo-files/.github/workflows/org-pr-require-conventional-commit.yml
index 5e5f84ef..ffb1fc79 100644
--- a/tf/deployment/modules/shared/github/org/repo-files/.github/workflows/org-pr-require-conventional-commit.yml
+++ b/tf/deployment/modules/shared/github/org/repo-files/.github/workflows/org-pr-require-conventional-commit.yml
@@ -7,6 +7,6 @@ on:
 jobs:
   validate-pr-title:
     name: Validate PR Title (conventional commit)
-    uses: immich-app/devtools/.github/workflows/shared-pr-require-conventional-commit.yml@main
+    uses: immich-app/devtools/.github/workflows/shared-pr-require-conventional-commit.yml@203c5d39d83e790e0a0858f6058d82ad7dc2df5d # main
     permissions:
       pull-requests: write
diff --git a/tf/deployment/modules/shared/github/org/repo-files/.github/workflows/org-zizmor.yml b/tf/deployment/modules/shared/github/org/repo-files/.github/workflows/org-zizmor.yml
index 050e69b4..a26a32d3 100644
--- a/tf/deployment/modules/shared/github/org/repo-files/.github/workflows/org-zizmor.yml
+++ b/tf/deployment/modules/shared/github/org/repo-files/.github/workflows/org-zizmor.yml
@@ -8,7 +8,7 @@ on:
 jobs:
   zizmor:
     name: Zizmor
-    uses: immich-app/devtools/.github/workflows/shared-zizmor.yml@main
+    uses: immich-app/devtools/.github/workflows/shared-zizmor.yml@203c5d39d83e790e0a0858f6058d82ad7dc2df5d # main
     permissions:
       actions: read
       contents: read