diff --git a/.github/renovate/base.json5 b/.github/renovate/base.json5
index 24babb4..a38eda1 100644
--- a/.github/renovate/base.json5
+++ b/.github/renovate/base.json5
@@ -18,6 +18,13 @@
       addLabels: ["deps:actions"],
       matchManagers: ["github-actions"],
     },
+    {
+      description: "Pin 3rd-party actions",
+      extends: ["helpers:pinGitHubActionDigests"],
+      addLabels: ["deps:actions"],
+      matchManagers: ["github-actions"],
+      matchPackageNames: ["!actions/**"]
+    },
     {
       description: "Use the deps:npm label for npm manager packages (this means Renovate's npm manager).",
       addLabels: ["deps:npm"],