diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dffb44431..f0a018458 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,7 +18,7 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Checkout current branch
-        uses: actions/checkout@v3.3.0
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
       - name: Setup Scala and Java
         uses: olafurpg/setup-scala@v14
       - name: Cache scala dependencies
@@ -37,7 +37,7 @@ jobs:
         platform: ['JS', 'JVM', 'Native']
     steps:
       - name: Checkout current branch
-        uses: actions/checkout@v3.3.0
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
         with:
           fetch-depth: 0
       - name: Setup Scala and Java
@@ -73,7 +73,7 @@ jobs:
     if: github.event_name != 'pull_request'
     steps:
       - name: Checkout current branch
-        uses: actions/checkout@v3.3.0
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
         with:
           fetch-depth: 0
       - name: Setup Scala and Java
diff --git a/.github/workflows/site.yml b/.github/workflows/site.yml
index 69831efac..2ce3dcdaa 100644
--- a/.github/workflows/site.yml
+++ b/.github/workflows/site.yml
@@ -18,7 +18,7 @@ jobs:
     if: ${{ github.event_name == 'pull_request' }}
     steps:
     - name: Git Checkout
-      uses: actions/checkout@v3.3.0
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
       with:
         fetch-depth: '0'
     - name: Setup Scala
@@ -37,7 +37,7 @@ jobs:
     if: ${{ ((github.event_name == 'release') && (github.event.action == 'published')) || (github.event_name == 'workflow_dispatch') }}
     steps:
     - name: Git Checkout
-      uses: actions/checkout@v3.3.0
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
       with:
         fetch-depth: '0'
     - name: Setup Scala
@@ -61,7 +61,7 @@ jobs:
     if: ${{ (github.event_name == 'push') || ((github.event_name == 'release') && (github.event_name == 'published')) }}
     steps:
     - name: Git Checkout
-      uses: actions/checkout@v3.3.0
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
       with:
         ref: ${{ github.head_ref }}
         fetch-depth: '0'