diff --git a/.github/workflows/code-ranker.yml b/.github/workflows/code-ranker.yml
index 1a57727..208db7b 100644
--- a/.github/workflows/code-ranker.yml
+++ b/.github/workflows/code-ranker.yml
@@ -4,9 +4,12 @@ on:
   push:
 jobs:
   code-ranker:
-    uses: ffedoroff/code-ranker-ci/.github/workflows/report.yml@v1
+    # Pinned to an immutable commit SHA (supply-chain hardening).
+    uses: code-ranker-com/actions/.github/workflows/report.yml@42c2fba1acd7c99a71875c8eefa171224d8e683c
     permissions:
       id-token: write
       contents: read
-      pull-requests: write
+      # No pull-requests: write here — the code-ranker GitHub App posts (and
+      # updates in place) the report comment using its own installation
+      # token, not this workflow's GITHUB_TOKEN.
       security-events: write