diff --git a/.github/workflows/k8s-diff.yaml b/.github/workflows/k8s-diff.yaml
index fdb088dad..61ad1b346 100644
--- a/.github/workflows/k8s-diff.yaml
+++ b/.github/workflows/k8s-diff.yaml
@@ -8,7 +8,7 @@ jobs:
       - uses: actions/checkout@v3
         with:
           ref: ${{ github.event.pull_request.base.sha }}
-      - uses: cue-lang/setup-cue@v1.0.0
+      - uses: cue-lang/setup-cue@a93fa358375740cd8b0078f76355512b9208acb1 # v1.0.1
       - run: cue export ./k8s/magiclove/list.cue > list.json
       - uses: actions/upload-artifact@v3
         with:
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: cue-lang/setup-cue@v1.0.0
+      - uses: cue-lang/setup-cue@a93fa358375740cd8b0078f76355512b9208acb1 # v1.0.1
       - run: cue export ./k8s/magiclove/list.cue > list.json
       - uses: actions/upload-artifact@v3
         with:
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 90972c47c..4caa7f05e 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -6,5 +6,5 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: cue-lang/setup-cue@v1.0.0
+      - uses: cue-lang/setup-cue@a93fa358375740cd8b0078f76355512b9208acb1 # v1.0.1
       - run: cue export ./k8s/magiclove/list.cue