diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index 409b83e..f3acd66 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -7,7 +7,7 @@ jobs:
     name: lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v3
   test:
@@ -24,7 +24,7 @@ jobs:
           go install github.com/ory/go-acc@latest
 
       - name: git checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
 
       - name: Install dependencies
         run: |
@@ -49,7 +49,7 @@ jobs:
           go-version: '1.19'
 
       - name: git checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
 
       - name: install lint
         run: GO111MODULE=off go get golang.org/x/lint/golint
diff --git a/.github/workflows/release-please.yaml b/.github/workflows/release-please.yaml
index ba4f8a2..ea6750f 100644
--- a/.github/workflows/release-please.yaml
+++ b/.github/workflows/release-please.yaml
@@ -21,7 +21,7 @@ jobs:
     needs: release-please
     if: needs.release-please.outputs.release_created
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         with:
           fetch-depth: 0
       - run: git fetch --force --tags