diff --git a/.github/workflows/pypi-release.yml b/.github/workflows/pypi-release.yml
index 12a68d6..46a1f7b 100644
--- a/.github/workflows/pypi-release.yml
+++ b/.github/workflows/pypi-release.yml
@@ -82,4 +82,4 @@ jobs:
 
       - name: Publish to PyPI
         if: startsWith(github.ref, 'refs/tags/')
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e  # v1.13.0
diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index 6f6874c..e3df22f 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -1,6 +1,10 @@
 Changelog
 =========
 
+v0.8.5
+--------
+- Update pypa gh-action-pypi-publish tag to fixed commit SHA (https://github.com/aboutcode-org/fetchcode/pull/221)
+
 v0.8.4
 --------
 - Update GH release tag to fixed commit SHA (https://github.com/aboutcode-org/fetchcode/pull/219)