diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 0d5156fa484..d45f4a5fe39 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -43,7 +43,7 @@ jobs:
           check-latest: true
 
       # will use the latest release available for ko
-      - uses: imjasonh/setup-ko@78eea08f10db87a7a23a666a4a6fe2734f2eeb8d # v0.4
+      - uses: imjasonh/setup-ko@ace48d793556083a76f1e3e6068850c1f4a369aa 
 
       - name: Set up Cloud SDK
         uses: google-github-actions/auth@dac4e13deb3640f22e3ffe758fd3f95e6e89f712 # v0.8.1
diff --git a/.github/workflows/github-oidc.yaml b/.github/workflows/github-oidc.yaml
index ef45287c5aa..3d40b91205f 100644
--- a/.github/workflows/github-oidc.yaml
+++ b/.github/workflows/github-oidc.yaml
@@ -43,7 +43,7 @@ jobs:
           cache: true
 
       # Install tools.
-      - uses: imjasonh/setup-ko@78eea08f10db87a7a23a666a4a6fe2734f2eeb8d # v0.4
+      - uses: imjasonh/setup-ko@ace48d793556083a76f1e3e6068850c1f4a369aa 
 
       - name: build cosign from the HEAD
         run: |
diff --git a/.github/workflows/kind-verify-attestation.yaml b/.github/workflows/kind-verify-attestation.yaml
index e0bc9e55e42..2701e3a675f 100644
--- a/.github/workflows/kind-verify-attestation.yaml
+++ b/.github/workflows/kind-verify-attestation.yaml
@@ -51,7 +51,7 @@ jobs:
         check-latest: true
 
     # will use the latest release available for ko
-    - uses: imjasonh/setup-ko@78eea08f10db87a7a23a666a4a6fe2734f2eeb8d # v0.4
+    - uses: imjasonh/setup-ko@ace48d793556083a76f1e3e6068850c1f4a369aa 
 
     - name: Install yq
       uses: mikefarah/yq@3d11b0545dbc0712c2045dc9e8b6c95b298e824e # v4.25.1
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index a07bb3895e3..27a0c122af4 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -101,7 +101,7 @@ jobs:
         with:
           go-version: ${{ env.GO_VERSION }}
           check-latest: true
-      - uses: imjasonh/setup-ko@78eea08f10db87a7a23a666a4a6fe2734f2eeb8d # v0.4
+      - uses: imjasonh/setup-ko@ace48d793556083a76f1e3e6068850c1f4a369aa 
       - name: setup kind cluster
         run: |
           # Used to test: cosign generate-key-pair k8s://...