diff --git a/.github/workflows/publish-shims.yml b/.github/workflows/publish-shims.yml
index 40604573..19afdd4c 100644
--- a/.github/workflows/publish-shims.yml
+++ b/.github/workflows/publish-shims.yml
@@ -64,7 +64,10 @@ jobs:
       - name: Build package
         working-directory: shims/pypi
         run: |
-          pip install build
+          pip install 'build==1.5.0' \
+            --require-hashes \
+            --hash=sha256:13f3eecb844759ab66efec90ca17639bbf14dc06cb2fdf37a9010322d9c50a6f \
+            --hash=sha256:302c22c3ba2a0fd5f3911918651341ebb3896176cbdec15bd421f80b1afc7647
           python -m build
       - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0