diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 6f68144de632..8fd9c22a9fe7 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -508,7 +508,7 @@ jobs:
         with:
           node-version-file: 'package.json'
       - name: Set up Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
         with:
           bun-version: '1.3.14'
       - name: Restore caches
@@ -892,7 +892,7 @@ jobs:
         with:
           node-version-file: 'package.json'
       - name: Set up Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
         with:
           bun-version: '1.3.14'
       - name: Restore caches
@@ -986,7 +986,7 @@ jobs:
         if:
           contains(fromJSON('["node-exports-test-app","nextjs-16-bun", "elysia-bun", "hono-4", "bun-bytecode"]'),
           matrix.test-application)
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
         with:
           bun-version: '1.3.14'
       - name: Set up AWS SAM