diff --git a/.github/workflows/nodejs.yml b/.github/workflows/nodejs.yml
index 405302107ff..fa1d3539a5a 100644
--- a/.github/workflows/nodejs.yml
+++ b/.github/workflows/nodejs.yml
@@ -100,7 +100,7 @@ jobs:
 
       - name: Coverage Report
         if: matrix.runs-on == 'ubuntu-latest' && matrix.node-version == 20
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@54bcd8715eee62d40e33596ef5e8f0f48dbbccab # v4.1.0
         with:
           token: ${{ secrets.CODECOV_TOKEN }}