diff --git a/.github/workflows/bump-plugin-shas.yml b/.github/workflows/bump-plugin-shas.yml
index 4ea47b8..9b11d9b 100644
--- a/.github/workflows/bump-plugin-shas.yml
+++ b/.github/workflows/bump-plugin-shas.yml
@@ -79,7 +79,7 @@ jobs:
           [[ "$DRY_RUN" = "true" ]] && args+=(--dry-run)
           python3 .github/scripts/discover_bumps.py "${args[@]}"
 
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 (sha-pinned)
         if: steps.existing.outputs.count == '0' && steps.discover.outputs.count != '0' && inputs.dry_run != true
 
       - name: Validate marketplace.json
diff --git a/.github/workflows/validate-frontmatter.yml b/.github/workflows/validate-frontmatter.yml
index dc2ea6a..243455d 100644
--- a/.github/workflows/validate-frontmatter.yml
+++ b/.github/workflows/validate-frontmatter.yml
@@ -17,7 +17,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 (sha-pinned)
 
       - name: Install dependencies
         run: cd .github/scripts && bun install yaml
diff --git a/.github/workflows/validate-marketplace.yml b/.github/workflows/validate-marketplace.yml
index abf3b38..ca73301 100644
--- a/.github/workflows/validate-marketplace.yml
+++ b/.github/workflows/validate-marketplace.yml
@@ -11,7 +11,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 (sha-pinned)
 
       - name: Validate marketplace.json
         run: bun .github/scripts/validate-marketplace.ts .claude-plugin/marketplace.json