diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 914a4727..fcd0d981 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -39,7 +39,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
     - name: Set up JDK
       uses: actions/setup-java@v3
       with:
diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index b33bdfee..ae2f946b 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ${{ matrix.os }}
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         with:
           fetch-depth: 0 # need git history for spotless license header
       - name: Set up JDK ${{ matrix.java }}
@@ -46,7 +46,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       - name: Set up JDK
         uses: actions/setup-java@v3
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2afec573..f545200e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,7 +17,7 @@ jobs:
     steps:
       - name: Validate is valid version
         run: npx -y semver $VERSION
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         with:
           fetch-depth: 0 # need git history for spotless license header
           token: ${{ secrets.GH_TOKEN_CHAOS_BOT }}
diff --git a/.github/workflows/releasetag.yml b/.github/workflows/releasetag.yml
index 01c72be0..49706577 100644
--- a/.github/workflows/releasetag.yml
+++ b/.github/workflows/releasetag.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         with:
           fetch-depth: 0 # need git history for spotless license header
       - name: Set up JDK 17
@@ -58,7 +58,7 @@ jobs:
     steps:
       - name: Set TAG_NAME without ref
         run: echo "TAG_NAME_WITHOUT_REF=${TAG_NAME//refs\/tags\/}" >> $GITHUB_ENV
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         with:
           fetch-depth: 0 # need git history for spotless license header
       - name: Set up JDK 17