diff --git a/.github/workflows/check-license.yml b/.github/workflows/check-license.yml
index 73b3de27..2ae3b915 100644
--- a/.github/workflows/check-license.yml
+++ b/.github/workflows/check-license.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
 
       - name: Check for files without license header
         run: "! grep -rL --include='*.go' -e'// Copyright (c) Edgeless Systems GmbH.' -e'DO NOT EDIT' | grep ''"
diff --git a/.github/workflows/docs-update-reference.yml b/.github/workflows/docs-update-reference.yml
index 40a4a3c8..2f2e7d47 100644
--- a/.github/workflows/docs-update-reference.yml
+++ b/.github/workflows/docs-update-reference.yml
@@ -9,7 +9,7 @@ jobs:
   pull-request:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
         with:
           ref: ${{ !github.event.pull_request.head.repo.fork && github.head_ref || '' }}
 
diff --git a/.github/workflows/links.yml b/.github/workflows/links.yml
index 4bf397c4..2b906acf 100644
--- a/.github/workflows/links.yml
+++ b/.github/workflows/links.yml
@@ -16,7 +16,7 @@ jobs:
   linkChecker:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
 
       - name: Link Checker
         uses: lycheeverse/lychee-action@ec3ed119d4f44ad2673a7232460dc7dff59d2421 # v1.8.0
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 323c2559..86e87eae 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-22.04
     container: ghcr.io/edgelesssys/edgelessrt-dev:ci
     steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
 
       - name: golangci-lint
         uses: golangci/golangci-lint-action@3a919529898de77ec3da873e3063ca4b10e7f5cc # v3.7.0
diff --git a/.github/workflows/unittests.yml b/.github/workflows/unittests.yml
index c6c56e5e..7ee75fb6 100644
--- a/.github/workflows/unittests.yml
+++ b/.github/workflows/unittests.yml
@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
       - name: Test
         run: ertgo test -race -count=3 ./...
diff --git a/.github/workflows/update-cli-reference.yml b/.github/workflows/update-cli-reference.yml
index dc62c766..e5daf1ec 100644
--- a/.github/workflows/update-cli-reference.yml
+++ b/.github/workflows/update-cli-reference.yml
@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           ref: ${{ !github.event.pull_request.head.repo.fork && github.head_ref || '' }}
 
diff --git a/.github/workflows/vale.yml b/.github/workflows/vale.yml
index 0b649cab..96d0984c 100644
--- a/.github/workflows/vale.yml
+++ b/.github/workflows/vale.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
       - name: Vale
         uses: errata-ai/vale-action@c4213d4de3d5f718b8497bd86161531c78992084 # v2