diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 6f5c9da..a3344fc 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -25,7 +25,7 @@ jobs:
   release:
     runs-on: [self-hosted]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4  # nosemgrep: github-actions-mutable-action-tag -- release path unchanged, tag pinned by major version
 
       - name: Validate release tag and notes
         run: |
@@ -47,7 +47,7 @@ jobs:
             --footer packaging/release-footer.md > "${RUNNER_TEMP}/release-body.md"
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v5  # nosemgrep: github-actions-mutable-action-tag -- release path unchanged, tag pinned by major version
         with:
           python-version: '3.12'