diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
index 935ebe5..0f58e76 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -18,7 +18,7 @@ jobs:
       - uses: actions/setup-go@v4
         with:
           go-version: 1.*
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         with:
           fetch-depth: '0'
       - name: golangci-lint
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 71bcf4d..279e068 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -16,7 +16,7 @@ jobs:
         go: [ '1.20', '1.x' ]
     name: Tests
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       - name: Setup Go
         uses: actions/setup-go@v4
         with:
@@ -33,7 +33,7 @@ jobs:
         go: [ '1.x' ]
     name: Static checks
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       - name: Setup Go
         uses: actions/setup-go@v4
         with:
diff --git a/.github/workflows/semanticore.yml b/.github/workflows/semanticore.yml
index 5719559..4eed059 100644
--- a/.github/workflows/semanticore.yml
+++ b/.github/workflows/semanticore.yml
@@ -12,7 +12,7 @@ jobs:
         go: [ '1.*' ]
     name: Semanticore
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         with:
           fetch-depth: 0
       - name: Setup Go