diff --git a/.github/workflows/generate-sboms.yml b/.github/workflows/generate-sboms.yml
index 4429d7a4bc..efc34d8805 100644
--- a/.github/workflows/generate-sboms.yml
+++ b/.github/workflows/generate-sboms.yml
@@ -36,7 +36,7 @@ jobs:
           find scancodeio/ -type f -name "*.ABOUT" -exec cp {} "${{ env.INPUTS_PATH }}/about-files/" \;
 
       - name: Resolve the dependencies using ScanCode-action
-        uses: aboutcode-org/scancode-action@6e900c920928c44932e756e308561451b09ec58b
+        uses: aboutcode-org/scancode-action@76777db8400d719de67ba3e465c5881037b45cb9  # v0.1
         with:
           pipelines: "resolve_dependencies:DynamicResolver"
           inputs-path: ${{ env.INPUTS_PATH }}
diff --git a/.github/workflows/sca-integration-anchore.yml b/.github/workflows/sca-integration-anchore.yml
index 2142467e08..9c6d0aaac9 100644
--- a/.github/workflows/sca-integration-anchore.yml
+++ b/.github/workflows/sca-integration-anchore.yml
@@ -43,7 +43,7 @@ jobs:
           retention-days: 20
 
       - name: Import SBOM into ScanCode.io
-        uses: aboutcode-org/scancode-action@6e900c920928c44932e756e308561451b09ec58b
+        uses: aboutcode-org/scancode-action@76777db8400d719de67ba3e465c5881037b45cb9  # v0.1
         with:
           pipelines: "load_sbom"
           inputs-path: "anchore-grype-sbom.cdx.json"
diff --git a/.github/workflows/sca-integration-cdxgen.yml b/.github/workflows/sca-integration-cdxgen.yml
index 5955900387..acf8164241 100644
--- a/.github/workflows/sca-integration-cdxgen.yml
+++ b/.github/workflows/sca-integration-cdxgen.yml
@@ -46,7 +46,7 @@ jobs:
           retention-days: 20
 
       - name: Import SBOM into ScanCode.io
-        uses: aboutcode-org/scancode-action@6e900c920928c44932e756e308561451b09ec58b
+        uses: aboutcode-org/scancode-action@76777db8400d719de67ba3e465c5881037b45cb9  # v0.1
         with:
           pipelines: "load_sbom"
           inputs-path: "cdxgen-sbom.cdx.json"
diff --git a/.github/workflows/sca-integration-cyclonedx-gomod.yml b/.github/workflows/sca-integration-cyclonedx-gomod.yml
index 4442329737..cfb1fe5c09 100644
--- a/.github/workflows/sca-integration-cyclonedx-gomod.yml
+++ b/.github/workflows/sca-integration-cyclonedx-gomod.yml
@@ -46,7 +46,7 @@ jobs:
           retention-days: 20
 
       - name: Import SBOM into ScanCode.io
-        uses: aboutcode-org/scancode-action@6e900c920928c44932e756e308561451b09ec58b
+        uses: aboutcode-org/scancode-action@76777db8400d719de67ba3e465c5881037b45cb9  # v0.1
         with:
           pipelines: "load_sbom"
           inputs-path: "gomod-sbom.cdx.json"
diff --git a/.github/workflows/sca-integration-depscan.yml b/.github/workflows/sca-integration-depscan.yml
index 58c12d3072..03889ba7f4 100644
--- a/.github/workflows/sca-integration-depscan.yml
+++ b/.github/workflows/sca-integration-depscan.yml
@@ -51,7 +51,7 @@ jobs:
         run: pip uninstall --yes owasp-depscan
 
       - name: Import SBOM into ScanCode.io
-        uses: aboutcode-org/scancode-action@6e900c920928c44932e756e308561451b09ec58b
+        uses: aboutcode-org/scancode-action@76777db8400d719de67ba3e465c5881037b45cb9  # v0.1
         with:
           pipelines: "load_sbom"
           inputs-path: "reports/sbom-docker.vdr.json"
diff --git a/.github/workflows/sca-integration-ort-package-file.yml b/.github/workflows/sca-integration-ort-package-file.yml
index 57afa18f6f..89d4c4ea14 100644
--- a/.github/workflows/sca-integration-ort-package-file.yml
+++ b/.github/workflows/sca-integration-ort-package-file.yml
@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Analyze Docker image with ScanCode.io
-        uses: aboutcode-org/scancode-action@6e900c920928c44932e756e308561451b09ec58b
+        uses: aboutcode-org/scancode-action@76777db8400d719de67ba3e465c5881037b45cb9  # v0.1
         with:
           pipelines: "analyze_docker_image"
           input-urls:
diff --git a/.github/workflows/sca-integration-ort.yml b/.github/workflows/sca-integration-ort.yml
index 1d13937af1..b31ee6f0a7 100644
--- a/.github/workflows/sca-integration-ort.yml
+++ b/.github/workflows/sca-integration-ort.yml
@@ -57,7 +57,7 @@ jobs:
             reporter
 
       - name: Import SBOM into ScanCode.io
-        uses: aboutcode-org/scancode-action@6e900c920928c44932e756e308561451b09ec58b
+        uses: aboutcode-org/scancode-action@76777db8400d719de67ba3e465c5881037b45cb9  # v0.1
         with:
           pipelines: "load_sbom"
           inputs-path: "${{ env.ORT_RESULTS_PATH }}/bom.cyclonedx.json"
@@ -96,7 +96,7 @@ jobs:
             reporter
 
       - name: Import SBOM into ScanCode.io
-        uses: aboutcode-org/scancode-action@6e900c920928c44932e756e308561451b09ec58b
+        uses: aboutcode-org/scancode-action@76777db8400d719de67ba3e465c5881037b45cb9  # v0.1
         with:
           pipelines: "load_sbom"
           inputs-path: "${{ env.ORT_RESULTS_PATH }}/bom.cyclonedx.json"
@@ -158,7 +158,7 @@ jobs:
           name: npm-mime-types-2.1.26-ort-sboms
 
       - name: Import SBOM into ScanCode.io
-        uses: aboutcode-org/scancode-action@6e900c920928c44932e756e308561451b09ec58b
+        uses: aboutcode-org/scancode-action@76777db8400d719de67ba3e465c5881037b45cb9  # v0.1
         with:
           pipelines: "load_sbom"
           inputs-path: "bom.cyclonedx.json"
@@ -184,7 +184,7 @@ jobs:
          name: npm-mime-types-2.1.26-ort-sboms
 
      - name: Import SBOM into ScanCode.io
-       uses: aboutcode-org/scancode-action@6e900c920928c44932e756e308561451b09ec58b
+       uses: aboutcode-org/scancode-action@76777db8400d719de67ba3e465c5881037b45cb9  # v0.1
        with:
          pipelines: "load_sbom"
          inputs-path: "bom.cyclonedx.xml"
@@ -210,7 +210,7 @@ jobs:
           name: npm-mime-types-2.1.26-ort-sboms
 
       - name: Import SBOM into ScanCode.io
-        uses: aboutcode-org/scancode-action@6e900c920928c44932e756e308561451b09ec58b
+        uses: aboutcode-org/scancode-action@76777db8400d719de67ba3e465c5881037b45cb9  # v0.1
         with:
           pipelines: "load_sbom"
           inputs-path: "bom.spdx.json"
@@ -236,7 +236,7 @@ jobs:
           name: npm-mime-types-2.1.26-ort-sboms
 
       - name: Import SBOM into ScanCode.io
-        uses: aboutcode-org/scancode-action@6e900c920928c44932e756e308561451b09ec58b
+        uses: aboutcode-org/scancode-action@76777db8400d719de67ba3e465c5881037b45cb9  # v0.1
         with:
           pipelines: "load_sbom"
           inputs-path: "bom.spdx.yml"
diff --git a/.github/workflows/sca-integration-osv-scanner.yml b/.github/workflows/sca-integration-osv-scanner.yml
index 29bf3ee418..eb68f35d2d 100644
--- a/.github/workflows/sca-integration-osv-scanner.yml
+++ b/.github/workflows/sca-integration-osv-scanner.yml
@@ -51,7 +51,7 @@ jobs:
           retention-days: 20
 
       - name: Import SBOM into ScanCode.io
-        uses: aboutcode-org/scancode-action@6e900c920928c44932e756e308561451b09ec58b
+        uses: aboutcode-org/scancode-action@76777db8400d719de67ba3e465c5881037b45cb9  # v0.1
         with:
           pipelines: "load_sbom"
           inputs-path: "osv-sbom.spdx.json"
diff --git a/.github/workflows/sca-integration-sbom-tool.yml b/.github/workflows/sca-integration-sbom-tool.yml
index 44499d9098..54abf044e4 100644
--- a/.github/workflows/sca-integration-sbom-tool.yml
+++ b/.github/workflows/sca-integration-sbom-tool.yml
@@ -52,7 +52,7 @@ jobs:
         path: sbom-output
 
     - name: Import SBOM into ScanCode.io
-      uses: aboutcode-org/scancode-action@6e900c920928c44932e756e308561451b09ec58b
+      uses: aboutcode-org/scancode-action@76777db8400d719de67ba3e465c5881037b45cb9  # v0.1
       with:
         pipelines: "load_sbom"
         inputs-path: "sbom-output/_manifest/spdx_2.2/manifest.spdx.json"
diff --git a/.github/workflows/sca-integration-trivy.yml b/.github/workflows/sca-integration-trivy.yml
index 923a595293..1aab707794 100644
--- a/.github/workflows/sca-integration-trivy.yml
+++ b/.github/workflows/sca-integration-trivy.yml
@@ -45,7 +45,7 @@ jobs:
           retention-days: 20
 
       - name: Import SBOM into ScanCode.io
-        uses: aboutcode-org/scancode-action@6e900c920928c44932e756e308561451b09ec58b
+        uses: aboutcode-org/scancode-action@76777db8400d719de67ba3e465c5881037b45cb9  # v0.1
         with:
           pipelines: "load_sbom"
           inputs-path: "trivy-report.sbom.json"