diff --git a/.github/workflows/auto_import.yaml b/.github/workflows/auto_import.yaml
index 0be48ec7..820b3583 100644
--- a/.github/workflows/auto_import.yaml
+++ b/.github/workflows/auto_import.yaml
@@ -21,7 +21,7 @@ jobs:
           wget https://storage.googleapis.com/cve-osv-conversion/nvd/nvdcve-2.0-$year.json;
         done
     - run: |
-        go install github.com/google/osv/vulnfeeds/cmd/pypi@master
+        go install github.com/google/osv/vulnfeeds/cmd/pypi@09163b7629f5836e55fdf8a99e4514ecf4bec166
         for nvdfile in nvdcve-2.0-*.json; do
           pypi -false_positives triage/false_positives.yaml \
                -nvd_json $nvdfile \