diff --git a/.ai/memory.md b/.ai/memory.md
index b99e10a5..f9e49841 100644
--- a/.ai/memory.md
+++ b/.ai/memory.md
@@ -72,8 +72,8 @@
 
 - GitHub workflow linting should avoid `uses: docker://...` because org allowlist policy can reject it.
 - Preferred pattern for this repo is Homebrew-influenced and allowlist-friendly:
-  - use `Homebrew/actions/setup-homebrew@main`
-  - use `Homebrew/actions/cache-homebrew-prefix@main` to install `actionlint`/`shellcheck`
+  - use `Homebrew/actions/setup-homebrew@1f8e202ffddf94def7f42f6fa3a482e821489f9c # 2026.07.10.1`
+  - use `Homebrew/actions/cache-homebrew-prefix@1f8e202ffddf94def7f42f6fa3a482e821489f9c # 2026.07.10.1` to install `actionlint`/`shellcheck`
   - run `actionlint` via a `run:` step
 - Actionlint remains path-scoped to workflow changes for low CI overhead.
 
diff --git a/.github/workflows/swift_quality.yml b/.github/workflows/swift_quality.yml
index 0d8c3801..e8ed237d 100644
--- a/.github/workflows/swift_quality.yml
+++ b/.github/workflows/swift_quality.yml
@@ -39,7 +39,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Cache Homebrew prefix
-        uses: Homebrew/actions/cache-homebrew-prefix@main
+        uses: Homebrew/actions/cache-homebrew-prefix@1f8e202ffddf94def7f42f6fa3a482e821489f9c # 2026.07.10.1
         with:
           brewfile: true
           uninstall: true