diff --git a/.github/workflows/check-rendered-specs-stub.yml b/.github/workflows/check-rendered-specs-stub.yml
index 8176fd7854b..41601b9b0bf 100644
--- a/.github/workflows/check-rendered-specs-stub.yml
+++ b/.github/workflows/check-rendered-specs-stub.yml
@@ -32,7 +32,7 @@ jobs:
     # Prevent forks from running a stale/vulnerable copy of this stub with Actions enabled
     if: github.repository == 'microsoft/azurelinux'
     # Intentionally branch-pinned so the reusable workflow picks up updates automatically.
-    uses: microsoft/azurelinux/.github/workflows/check-rendered-specs.yml@4.0 # zizmor: ignore[unpinned-uses]
+    uses: microsoft/azurelinux/.github/workflows/check-rendered-specs.yml@fa509839f233bfeff1976577a0bd780cb5cb2e57 # 4.0
     permissions:
       contents: read
       pull-requests: write # Post/update/delete drift comments on PRs
diff --git a/.github/workflows/spec-review-stub.yml b/.github/workflows/spec-review-stub.yml
index 6bb0145fd1e..a648bee6b01 100644
--- a/.github/workflows/spec-review-stub.yml
+++ b/.github/workflows/spec-review-stub.yml
@@ -38,7 +38,7 @@ jobs:
     if: github.repository == 'microsoft/azurelinux'
     # Intentionally branch-pinned to our own repo so the
     # reusable workflow picks up prompt/script/agent updates automatically.
-    uses: microsoft/azurelinux/.github/workflows/spec-review.yml@4.0 # zizmor: ignore[unpinned-uses]
+    uses: microsoft/azurelinux/.github/workflows/spec-review.yml@fa509839f233bfeff1976577a0bd780cb5cb2e57 # 4.0
     permissions:
       contents: read
       pull-requests: write # Post review comments and inline annotations on PRs