diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 512cb1f56..18d1b7d1e 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -65,15 +65,14 @@ jobs:
       TAG_TIMESTAMP: ${{ github.sha }}-${{ needs.info.outputs.timestamp }}
 
     steps:
-      # TODO: Enabling this seems to cause the host to run out of disk space.
-      # - name: Harden Runner
-      #   uses: step-security/harden-runner@55d479fb1c5bcad5a4f9099a5d9f37c8857b2845 # v2.4.1
-      #   with:
-      #     egress-policy: audit
-      #     disable-telemetry: true
+      - name: Harden Runner
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        with:
+          egress-policy: audit
+          disable-telemetry: true
 
       - name: Free Disk Space (Ubuntu)
-        uses: jlumbroso/free-disk-space@main
+        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
         with:
           docker-images: false
           swap-storage: false
diff --git a/renovate.json b/renovate.json
index 2992cadb8..940036c1b 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,6 +1,7 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "github>conforma/.github//config/renovate/renovate.json"
+    "github>conforma/.github//config/renovate/renovate.json",
+    "helpers:pinGitHubActionDigests"
   ]
 }