diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 6a0dd1c..acbbe18 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -18,7 +18,7 @@ jobs:
       contents: read
       # the TCK test report is published as a check run
       checks: write
-    uses: osgi/.github/.github/workflows/spec-build.yml@main
+    uses: osgi/.github/.github/workflows/spec-build.yml@2608490dbf73ab697b457a9125b0b3ba462b6d72 # 0.0.1
     secrets: inherit
     with:
       deploy: ${{ github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d1a2d7f..793c44e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,5 +11,5 @@ permissions:
   contents: read
 jobs:
   release:
-    uses: osgi/.github/.github/workflows/spec-release.yml@main
+    uses: osgi/.github/.github/workflows/spec-release.yml@2608490dbf73ab697b457a9125b0b3ba462b6d72 # 0.0.1
     secrets: inherit