diff --git a/Dockerfile.github_action_dockerhub b/Dockerfile.github_action_dockerhub
index 61d64e2575..3f1db4bd59 100644
--- a/Dockerfile.github_action_dockerhub
+++ b/Dockerfile.github_action_dockerhub
@@ -1 +1,3 @@
-FROM codiumai/pr-agent:github_action
+# Pinned by digest so upstream can't change what runs with our secrets.
+# Tag: codiumai/pr-agent:github_action (last updated 2026-04-16)
+FROM codiumai/pr-agent:github_action@sha256:960571f0efbc88d96127c1ee7dac3059648dfa7c2109750fc92f315cf07979ed