diff --git a/auto-merge/contrib/renovate.json b/auto-merge/contrib/renovate.json
index 57188e226..5c1bc1ed4 100644
--- a/auto-merge/contrib/renovate.json
+++ b/auto-merge/contrib/renovate.json
@@ -1,6 +1,7 @@
 {
   "extends": [
-    "config:base"
+    "config:base",
+    "helpers:pinGitHubActionDigestsToSemver"
   ],
   "packageRules": [
     {
diff --git a/auto-merge/js/renovate.json b/auto-merge/js/renovate.json
index c7d143d79..bc2444e37 100644
--- a/auto-merge/js/renovate.json
+++ b/auto-merge/js/renovate.json
@@ -1,5 +1,5 @@
 {
-  "extends": ["config:base"],
+  "extends": ["config:base", "helpers:pinGitHubActionDigestsToSemver"],
   "packageRules": [
     {
       "groupName": "all patch versions",