diff --git a/.github/workflows/busted.yml b/.github/workflows/busted.yml
index 32b3a52a..79adc036 100644
--- a/.github/workflows/busted.yml
+++ b/.github/workflows/busted.yml
@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Setup ‘lua’
         uses: hishamhm/gh-actions-lua@master
diff --git a/.github/workflows/luacheck.yml b/.github/workflows/luacheck.yml
index 1a044a38..46881674 100644
--- a/.github/workflows/luacheck.yml
+++ b/.github/workflows/luacheck.yml
@@ -8,6 +8,6 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Luacheck
         uses: lunarmodules/luacheck@v1
diff --git a/.github/workflows/versioning.yml b/.github/workflows/versioning.yml
index e119cdb0..8fe6adb8 100644
--- a/.github/workflows/versioning.yml
+++ b/.github/workflows/versioning.yml
@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Update release tags
         uses: Actions-R-Us/actions-tagger@v2
         with: