diff --git a/code-scanning/synopsys-io-actions.yml b/code-scanning/synopsys-io-actions.yml
index 7501726..9b5a080 100644
--- a/code-scanning/synopsys-io-actions.yml
+++ b/code-scanning/synopsys-io-actions.yml
@@ -49,7 +49,7 @@ jobs:
     # in order for this logic to work
     - name: Software Composition Analysis with Black Duck
       if: ${{steps.prescription.outputs.scaScan == 'true' }}
-      uses: blackducksoftware/github-action@v2
+      uses: blackducksoftware/github-action@9ea442b34409737f64743781e9adc71fd8e17d38
       with:
          args: '--blackduck.url="${{ secrets.BLACKDUCK_URL}}" --blackduck.api.token="${{ secrets.BLACKDUCK_TOKEN}}" --detect.tools="SIGNATURE_SCAN,DETECTOR"'