diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 87900ac9..87992008 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -35,7 +35,7 @@ jobs:
     - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
     - name: Install cmake-format
-      run: pip install cmakelang
+      run: pip install --require-hashes -r support/cmake-format-requirements.txt
 
     - name: Run cmake-format
       run: |
diff --git a/support/cmake-format-requirements.txt b/support/cmake-format-requirements.txt
new file mode 100644
index 00000000..ee242a8c
--- /dev/null
+++ b/support/cmake-format-requirements.txt
@@ -0,0 +1,6 @@
+cmakelang==0.6.13 \
+    --hash=sha256:764b9467195c7c36453d60a829f30229720d26c7dffd41cb516b99bd9c7daf4e \
+    --hash=sha256:03982e87b00654d024d73ef972d9d9bb0e5726cdb6b8a424a15661fb6278e67f
+six==1.17.0 \
+    --hash=sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274 \
+    --hash=sha256:ff70335d468e7eb6ec65b95b99d3a2836546063f63acc5171de367e834932a81