diff --git a/.github/workflows/bump-openrouter-sdk.yaml b/.github/workflows/bump-openrouter-sdk.yaml
index ad7c841..3ef626f 100644
--- a/.github/workflows/bump-openrouter-sdk.yaml
+++ b/.github/workflows/bump-openrouter-sdk.yaml
@@ -47,7 +47,7 @@ jobs:
           persist-credentials: false
           fetch-depth: 0
 
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@73e46992e05b19abd31f2f3c20e0e7370d762115 # v6.1.1
 
       - uses: actions/setup-node@v6
         with:
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index b5b3281..148f4b7 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -27,7 +27,7 @@ jobs:
         with:
           fetch-depth: 2
 
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@73e46992e05b19abd31f2f3c20e0e7370d762115 # v6.1.1
 
       - uses: actions/setup-node@v6
         with:
@@ -46,7 +46,7 @@ jobs:
         with:
           fetch-depth: 2
 
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@73e46992e05b19abd31f2f3c20e0e7370d762115 # v6.1.1
 
       - uses: actions/setup-node@v6
         with:
@@ -65,7 +65,7 @@ jobs:
         with:
           fetch-depth: 2
 
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@73e46992e05b19abd31f2f3c20e0e7370d762115 # v6.1.1
 
       - uses: actions/setup-node@v6
         with:
@@ -101,7 +101,7 @@ jobs:
         with:
           fetch-depth: 2
 
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@73e46992e05b19abd31f2f3c20e0e7370d762115 # v6.1.1
 
       - uses: actions/setup-node@v6
         with:
@@ -140,7 +140,7 @@ jobs:
           echo "::error::OPENROUTER_API_KEY secret is not set; refusing to skip e2e tests outside of fork PRs."
           exit 1
 
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@73e46992e05b19abd31f2f3c20e0e7370d762115 # v6.1.1
         if: env.SKIP_E2E != '1'
 
       - uses: actions/setup-node@v6
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 7a5a154..e6fb0d5 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -75,7 +75,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@73e46992e05b19abd31f2f3c20e0e7370d762115 # v6.1.1
 
       # npm trusted publishing (OIDC) requires npm >= 11.5.1, which means Node
       # 24 — Node 22 ships npm 10.x, which has no OIDC token-exchange support at