diff --git a/CHANGELOG.md b/CHANGELOG.md
index fabaa3cd..ca3a227a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,7 @@
 - `--report-junit <file>` flag as an alias of `--log-junit`, for naming parity with `--report-html` (#705)
 
 ### Changed
+- The GitHub Action's `version` input now defaults to the version pinned at the action ref instead of `latest`, so pinning the action by SHA pins a visible bashunit version
 - `install.sh` now verifies the release checksum by default (set `BASHUNIT_VERIFY_CHECKSUM=false` to opt out); it soft-skips with a warning when a checksum asset is unavailable unless verification was explicitly requested (#703)
 - `--log-gha` annotations now include the failing test's `line` (`::error file=…,line=…`), so they pin to the exact line in a pull request's "Files changed" tab (#704)
 
diff --git a/action.yml b/action.yml
index 3a5bb631..0a5fe20e 100644
--- a/action.yml
+++ b/action.yml
@@ -8,9 +8,9 @@ branding:
 
 inputs:
   version:
-    description: 'bashunit version to install (e.g. "0.37.0") or "latest".'
+    description: 'bashunit version to install (e.g. "0.37.0"). Defaults to the version pinned at this action ref. Pass "latest" to override.'
     required: false
-    default: latest
+    default: '0.38.0'
   directory:
     description: 'Directory, relative to the workspace, where the bashunit binary is installed.'
     required: false
diff --git a/release.sh b/release.sh
index a6b8f344..3b16a52a 100755
--- a/release.sh
+++ b/release.sh
@@ -13,7 +13,7 @@ declare -r EXIT_EXECUTION_ERROR=2
 # Constants
 GITHUB_REPO_PATH="TypedDevs/bashunit"
 GITHUB_REPO_URL="https://github.com/${GITHUB_REPO_PATH}"
-RELEASE_FILES=("bashunit" "install.sh" "package.json" "docs/package.json" "CHANGELOG.md")
+RELEASE_FILES=("bashunit" "install.sh" "action.yml" "package.json" "docs/package.json" "CHANGELOG.md")
 
 # Helper function for regex matching (Bash 3.0+ compatible)
 function regex_match() {
@@ -509,6 +509,7 @@ function release::sandbox::run() {
   # Run release steps in sandbox (cd already done in setup_git)
   release::update_bashunit_version "$VERSION"
   release::update_install_version "$VERSION"
+  release::update_action_version "$VERSION"
   release::update_package_json_version "$VERSION"
   release::update_changelog "$VERSION" "$CURRENT_VERSION"
 
@@ -631,6 +632,15 @@ function release::update_install_version() {
     "LATEST_BASHUNIT_VERSION"
 }
 
+function release::update_action_version() {
+  local new_version=$1
+  release::update_file_pattern \
+    "action.yml" \
+    "default: '[0-9][^']*'" \
+    "default: '$new_version'" \
+    "action.yml default version"
+}
+
 function release::update_package_json_version() {
   local new_version=$1
   release::update_file_pattern \
@@ -1033,6 +1043,9 @@ function release::main() {
   release::update_install_version "$VERSION"
   release::state::record_step "update_install_version"
 
+  release::update_action_version "$VERSION"
+  release::state::record_step "update_action_version"
+
   release::update_package_json_version "$VERSION"
   release::state::record_step "update_package_json_version"
 
diff --git a/tests/unit/fixtures/release/mock_action.yml b/tests/unit/fixtures/release/mock_action.yml
new file mode 100644
index 00000000..f5d377b7
--- /dev/null
+++ b/tests/unit/fixtures/release/mock_action.yml
@@ -0,0 +1,12 @@
+name: Install bashunit
+inputs:
+  version:
+    description: 'bashunit version to install.'
+    required: false
+    default: '0.30.0'
+  directory:
+    required: false
+    default: lib
+  add-to-path:
+    required: false
+    default: 'true'
diff --git a/tests/unit/release_update_test.sh b/tests/unit/release_update_test.sh
index 4dae21b3..7ffeb5e3 100644
--- a/tests/unit/release_update_test.sh
+++ b/tests/unit/release_update_test.sh
@@ -103,6 +103,30 @@ function test_update_install_version_changes_version_string() {
   rm -rf "$temp_dir"
 }
 
+function test_update_action_version_changes_only_numeric_default() {
+  local temp_dir
+  temp_dir=$(mktemp -d)
+
+  cp "$FIXTURES_DIR/mock_action.yml" "$temp_dir/action.yml"
+
+  DRY_RUN=false
+  (
+    cd "$temp_dir" || return
+    release::update_action_version "0.31.0" 2>/dev/null
+  )
+
+  local result
+  result=$(cat "$temp_dir/action.yml")
+  # The version default is bumped...
+  assert_contains "default: '0.31.0'" "$result"
+  # ...but non-numeric defaults are left untouched.
+  assert_contains "default: lib" "$result"
+  assert_contains "default: 'true'" "$result"
+  assert_not_contains "default: '0.30.0'" "$result"
+
+  rm -rf "$temp_dir"
+}
+
 function test_update_package_json_version_changes_version_string() {
   local temp_dir
   temp_dir=$(mktemp -d)