diff --git a/.github/workflows/build-and-deploy.yml b/.github/workflows/build-and-deploy.yml
index dee67bfa1..3b514e07c 100644
--- a/.github/workflows/build-and-deploy.yml
+++ b/.github/workflows/build-and-deploy.yml
@@ -46,7 +46,7 @@ jobs:
 
       - name: Upload coverage reports
         if: false  # Disabled until codecov is configured
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5
         with:
           file: ./backend/coverage.out
           flags: backend
@@ -89,7 +89,7 @@ jobs:
 
       - name: Upload coverage reports
         if: false  # Disabled until codecov is configured
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5
         with:
           file: ./frontend/coverage/lcov.info
           flags: frontend