diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 58b57eda6..f1b890e80 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -31,7 +31,7 @@ jobs:
         with:
           persist-credentials: false
       - name: 'REUSE compliance check'
-        uses: fsfe/reuse-action@v5
+        uses: fsfe/reuse-action@bb774aa972c2a89ff34781233d275075cbddf542 # v5
 
   shellcheck:
     runs-on: 'ubuntu-latest'