diff --git a/.github/workflows/build-pelican.yml b/.github/workflows/build-pelican.yml
index 212260d..453f87c 100644
--- a/.github/workflows/build-pelican.yml
+++ b/.github/workflows/build-pelican.yml
@@ -13,12 +13,15 @@ on:
 jobs:
   build-pelican:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write   # because we push to asf-site
     steps:
       - uses: actions/checkout@v4
         with:
+          persist-credentials: false
           # This must equal the push/branches list above, and be appropriate for the destination below
           ref: 'main'
-      - uses: apache/infrastructure-actions/pelican@main
+      - uses: apache/infrastructure-actions/pelican@ed044141796eb8ad67581cf5f4210656ffa77daa
         with:
           # This must be appropriate for the branch being built
           destination: 'asf-site'