diff --git a/.github/workflows/codecov.yml b/.github/workflows/codecov.yml
index fe6ec72..9b35655 100644
--- a/.github/workflows/codecov.yml
+++ b/.github/workflows/codecov.yml
@@ -4,7 +4,7 @@ on:
   workflow_call:
     secrets:
       CODECOV_TOKEN:
-          required: true
+        required: true
   push:
     branches: [ main ]
   pull_request:
@@ -23,6 +23,6 @@ jobs:
         run: make dependencies || true # Used in fortio for instance to prep for go tests
       - name: Run test coverage
         run: go test -coverprofile=coverage.out ./...
-      - uses: codecov/codecov-action@v4
+      - uses: codecov/codecov-action@54bcd8715eee62d40e33596ef5e8f0f48dbbccab # pin@v4
         with:
           files: coverage.out