diff --git a/.github/workflows/charts-lint.yaml b/.github/workflows/charts-lint.yaml
index 92c2cf68..bb5b36c0 100644
--- a/.github/workflows/charts-lint.yaml
+++ b/.github/workflows/charts-lint.yaml
@@ -36,7 +36,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         with:
           fetch-depth: 0
           ref: ${{ inputs.checkoutCommit }}
diff --git a/.github/workflows/charts-release-ghpages.yaml b/.github/workflows/charts-release-ghpages.yaml
index 2854c83e..be13af47 100644
--- a/.github/workflows/charts-release-ghpages.yaml
+++ b/.github/workflows/charts-release-ghpages.yaml
@@ -32,14 +32,14 @@ jobs:
           private_key: ${{ secrets.BJWS_APP_PRIVATE_KEY }}
 
       - name: Checkout charts branch
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         with:
           token: ${{ steps.get-app-token.outputs.token }}
           path: "src"
           fetch-depth: 0
 
       - name: Checkout gh-pages branch
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         with:
           token: ${{ steps.get-app-token.outputs.token }}
           path: "dest"
diff --git a/.github/workflows/charts-release-oci.yaml b/.github/workflows/charts-release-oci.yaml
index 0247c2ca..a5c58dda 100644
--- a/.github/workflows/charts-release-oci.yaml
+++ b/.github/workflows/charts-release-oci.yaml
@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout chart sources
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/charts-release.yaml b/.github/workflows/charts-release.yaml
index 2a51a4db..a39956cd 100644
--- a/.github/workflows/charts-release.yaml
+++ b/.github/workflows/charts-release.yaml
@@ -30,7 +30,7 @@ jobs:
       applicationChartsToRelease: ${{ steps.collect-charts.outputs.chartsApplication }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/charts-test.yaml b/.github/workflows/charts-test.yaml
index efeecc8a..6c11fb39 100644
--- a/.github/workflows/charts-test.yaml
+++ b/.github/workflows/charts-test.yaml
@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         with:
           fetch-depth: 0
           ref: ${{ inputs.checkoutCommit }}
@@ -97,7 +97,7 @@ jobs:
       fail-fast: false
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         with:
           fetch-depth: 0
           ref: ${{ inputs.checkoutCommit }}
diff --git a/.github/workflows/docs-release.yaml b/.github/workflows/docs-release.yaml
index 904de789..c1345c09 100644
--- a/.github/workflows/docs-release.yaml
+++ b/.github/workflows/docs-release.yaml
@@ -24,7 +24,7 @@ jobs:
           private_key: ${{ secrets.BJWS_APP_PRIVATE_KEY }}
 
       - name: Checkout main branch
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         with:
           token: ${{ steps.get-app-token.outputs.token }}
           fetch-depth: 0
diff --git a/.github/workflows/pr-metadata.yaml b/.github/workflows/pr-metadata.yaml
index 4fc56b55..a03e5e85 100644
--- a/.github/workflows/pr-metadata.yaml
+++ b/.github/workflows/pr-metadata.yaml
@@ -64,7 +64,7 @@ jobs:
       commonLibraryUpdated: ${{ contains(fromJSON(steps.changed-charts.outputs.charts), 'library/common') }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/pre-commit-check.yaml b/.github/workflows/pre-commit-check.yaml
index 40839f69..96174ee7 100644
--- a/.github/workflows/pre-commit-check.yaml
+++ b/.github/workflows/pre-commit-check.yaml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
 
       - name: Run against changes
         uses: pre-commit/action@v3.0.0