diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index df3e628..cd6fb1b 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -84,7 +84,7 @@ jobs:
     - name: Upload the build artifact
       if: github.event_name == 'push'
       # Do not use v4 until merge behavior can be rebuilt
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3
       with:
         # By uploading to the same artifact we can download all of the packages
         # and upload them all to anaconda.org in a single job