diff --git a/renovate.json b/renovate.json
index 9322626e..f768006c 100644
--- a/renovate.json
+++ b/renovate.json
@@ -19,6 +19,12 @@
     {
       "matchPackageNames": ["debian"],
       "groupName": "Debian base images"
+    },
+    {
+      "matchDepTypes": [
+          "action"
+      ],
+      "pinDigests": true
     }
   ]
 }
\ No newline at end of file