diff --git a/.github/workflows/charts-publish-oci.yaml b/.github/workflows/charts-publish-oci.yaml
index 2c19779..88bcda0 100644
--- a/.github/workflows/charts-publish-oci.yaml
+++ b/.github/workflows/charts-publish-oci.yaml
@@ -15,7 +15,7 @@
         packages: write
       runs-on: ubuntu-22.04
       steps:
-        - uses: actions/checkout@v4
+        - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
           with:
             fetch-depth: 0
 
diff --git a/.github/workflows/publish-image-init.yaml b/.github/workflows/publish-image-init.yaml
index cb9d058..c785255 100644
--- a/.github/workflows/publish-image-init.yaml
+++ b/.github/workflows/publish-image-init.yaml
@@ -39,7 +39,7 @@
 
       steps:
         - name: Checkout repository
-          uses: actions/checkout@v4
+          uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
           with:
             fetch-depth: 0
 
diff --git a/.github/workflows/publish-image-webhook.yaml b/.github/workflows/publish-image-webhook.yaml
index 79cd287..b65d712 100644
--- a/.github/workflows/publish-image-webhook.yaml
+++ b/.github/workflows/publish-image-webhook.yaml
@@ -38,7 +38,7 @@
 
       steps:
         - name: Checkout repository
-          uses: actions/checkout@v4
+          uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
           with:
             fetch-depth: 0
 
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 62ffbd9..56e819f 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -24,7 +24,7 @@ jobs:
           manifest-file: .github/.release-please-manifest.json
 
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         if: ${{ steps.release.outputs.release_created }} || ${{ steps.release.outputs.releases_created }}
         with:
           fetch-depth: 0