diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml
index 6fa8baf6..be00782c 100644
--- a/.github/workflows/conformance.yml
+++ b/.github/workflows/conformance.yml
@@ -39,8 +39,7 @@ jobs:
 
       - run: go build -o conformance cmd/conformance/main.go
 
-      - uses: sigstore/sigstore-conformance@main # maybe we should pin this in the future, once sigstore-conformance development slows down?
+      - uses: sigstore/sigstore-conformance@c8d17eb7ee884cf86b93a3a3f471648fb0a83819 # v0.0.9
         with:
           entrypoint: ${{ github.workspace }}/conformance
           skip-signing: true
-          supports-trusted-root: true