diff --git a/eng/common/pipelines/templates/jobs/apireview-hub-generate-artifact-base.yml b/eng/common/pipelines/templates/jobs/apireview-hub-generate-artifact-base.yml
index aef5f99e5..ccfbfbf00 100644
--- a/eng/common/pipelines/templates/jobs/apireview-hub-generate-artifact-base.yml
+++ b/eng/common/pipelines/templates/jobs/apireview-hub-generate-artifact-base.yml
@@ -42,7 +42,10 @@ jobs:
       - name: BinDirectory
         value: $(Pipeline.Workspace)/bin
       - name: ApiReviewSourceCommit
-        value: ''
+        ${{ if eq(parameters.kind, 'base') }}:
+          value: $(ApiReviewBaseCommit)
+        ${{ if eq(parameters.kind, 'target') }}:
+          value: $(ApiReviewTargetCommit)
       - name: ArtifactOutputDirectory
         value: $(Build.ArtifactStagingDirectory)/${{ parameters.kind }}
     steps:
@@ -55,6 +58,10 @@ jobs:
             echo "ref must be a fully-qualified branch or tag ref." >&2
             exit 1
           fi
+          if [[ ! "$SOURCE_COMMIT" =~ ^[0-9a-fA-F]{40}$ ]]; then
+            echo "A pinned 40-character source commit SHA is required." >&2
+            exit 1
+          fi
           if [[ ! "$REPOSITORY_FULL_NAME" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]; then
             echo "repositoryFullName must be in owner/repository form." >&2
             exit 1
@@ -72,16 +79,21 @@ jobs:
           mkdir -p "$SOURCE_DIRECTORY"
           git -C "$SOURCE_DIRECTORY" init
           git -C "$SOURCE_DIRECTORY" remote add origin "https://github.com/$REPOSITORY_FULL_NAME.git"
-          git -C "$SOURCE_DIRECTORY" fetch --depth=1 origin "$REF"
+          git -C "$SOURCE_DIRECTORY" fetch --depth=1 origin "$SOURCE_COMMIT"
           git -C "$SOURCE_DIRECTORY" checkout --detach FETCH_HEAD
           git -C "$SOURCE_DIRECTORY" clean -ffd
 
           source_commit=$(git -C "$SOURCE_DIRECTORY" rev-parse HEAD)
+          if [[ "${source_commit,,}" != "${SOURCE_COMMIT,,}" ]]; then
+            echo "Checked-out source commit does not match the requested SHA." >&2
+            exit 1
+          fi
           echo "ref=$REF sourceCommit=$source_commit"
           echo "##vso[task.setvariable variable=ApiReviewSourceCommit]$source_commit"
         displayName: Clone ${{ parameters.kind }} source ref
         env:
           REF: ${{ parameters.ref }}
+          SOURCE_COMMIT: $(ApiReviewSourceCommit)
           REPOSITORY_FULL_NAME: ${{ parameters.repositoryFullName }}
           SOURCE_DIRECTORY: $(Build.SourcesDirectory)
           PACKAGE_NAME: ${{ parameters.packageName }}
diff --git a/eng/common/pipelines/templates/steps/apireview-hub-failure-callback.yml b/eng/common/pipelines/templates/steps/apireview-hub-failure-callback.yml
index eec67b8ac..91a439d05 100644
--- a/eng/common/pipelines/templates/steps/apireview-hub-failure-callback.yml
+++ b/eng/common/pipelines/templates/steps/apireview-hub-failure-callback.yml
@@ -37,6 +37,7 @@ steps:
           language = $env:LANGUAGE
           kind = $env:KIND
           ref = $env:REF
+          sourceCommit = $env:SOURCE_COMMIT
           result = 'Failed'
           artifactName = $env:ARTIFACT_NAME
           buildId = $env:BUILD_ID
@@ -53,8 +54,10 @@ steps:
     env:
       ${{ if eq(parameters.kind, 'base') }}:
         CALLBACK_PROOF: $(BaseCallbackProof)
+        SOURCE_COMMIT: $(ApiReviewBaseCommit)
       ${{ if eq(parameters.kind, 'target') }}:
         CALLBACK_PROOF: $(TargetCallbackProof)
+        SOURCE_COMMIT: $(ApiReviewTargetCommit)
       CALLBACK_RESOURCE_URL: $(CompletionCallbackResourceUrl)
       API_REVIEW_HUB_ENDPOINT: $(ApiReviewHubEndpoint)
       OPERATION_ID: $(ApiReviewOperationId)