diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a28e1874..68b48b0c 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -34,6 +34,6 @@ jobs:
         run: dotnet test --no-build --configuration Debug --collect:"XPlat Code Coverage"
 
       - name: Upload coverage reports to Codecov
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d # v3
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}