diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 94795b2e..e8949d20 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -60,7 +60,7 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version: "24"
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
       - name: Install Python deps (langgraph dev runtime)
         run: uv sync --locked
       - name: Install Playwright + Chromium
@@ -117,7 +117,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
       - name: ui/package.json and ui/bun.lock agree
         working-directory: ui
         run: bun install --frozen-lockfile