diff --git a/.github/workflows/merge.yml b/.github/workflows/merge.yml
index d3aca73ec..a4d482001 100644
--- a/.github/workflows/merge.yml
+++ b/.github/workflows/merge.yml
@@ -49,7 +49,7 @@ jobs:
       run: mvn --batch-mode --update-snapshots verify
 
     - name: Upload coverage to Codecov
-      uses: codecov/codecov-action@b65fbdcf9751c92f3e0ac5e72616e5d5dd72bcdb
+      uses: codecov/codecov-action@v3.1.4
       with:
         token: ${{ secrets.CODECOV_TOKEN }} # not required for public repos
         flags: unittests # optional
diff --git a/.github/workflows/pullrequest.yml b/.github/workflows/pullrequest.yml
index 3340422d6..b570efe23 100644
--- a/.github/workflows/pullrequest.yml
+++ b/.github/workflows/pullrequest.yml
@@ -36,7 +36,7 @@ jobs:
         run: mvn --batch-mode --update-snapshots --activate-profiles e2e verify
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@b65fbdcf9751c92f3e0ac5e72616e5d5dd72bcdb
+        uses: codecov/codecov-action@v3.1.4
         with:
           token: ${{ secrets.CODECOV_TOKEN }} # not required for public repos
           flags: unittests # optional
diff --git a/renovate.json b/renovate.json
index 62574107d..d3b4a0c60 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,8 +1,7 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "config:base",
-    "helpers:pinGitHubActionDigests"
+    "config:base"
   ],
   "packageRules": [
     {