diff --git a/.github/workflows/auto_publish_release.yml b/.github/workflows/auto_publish_release.yml
index 593fd6529e..4a3998e56c 100644
--- a/.github/workflows/auto_publish_release.yml
+++ b/.github/workflows/auto_publish_release.yml
@@ -22,7 +22,7 @@ jobs:
     steps:
 
       - name: Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         with:
           ref: ${{ env.MERGE_SHA }}
 
diff --git a/.github/workflows/create_release_pr.yml b/.github/workflows/create_release_pr.yml
index c5636a064f..de54ade201 100644
--- a/.github/workflows/create_release_pr.yml
+++ b/.github/workflows/create_release_pr.yml
@@ -21,7 +21,7 @@ jobs:
         uses: cylc/release-actions/stage-1/sanitize-inputs@v1
 
       - name: Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         with:
           ref: ${{ env.BASE_REF }}
           fetch-depth: 0  # need to fetch all commits to check contributors
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 2506515975..5978092544 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
 
       - name: Setup Node
         uses: actions/setup-node@v3
@@ -64,7 +64,7 @@ jobs:
       COVERAGE: true
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
 
       - name: Setup Node
         uses: actions/setup-node@v3
diff --git a/.github/workflows/shortlog.yml b/.github/workflows/shortlog.yml
index 7998d92ad3..567cfd8b9f 100644
--- a/.github/workflows/shortlog.yml
+++ b/.github/workflows/shortlog.yml
@@ -14,7 +14,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         with:
           fetch-depth: 0  # need to fetch all commits to check contributors
 
diff --git a/.github/workflows/update_copyright.yml b/.github/workflows/update_copyright.yml
index ded719288b..5f12357a63 100644
--- a/.github/workflows/update_copyright.yml
+++ b/.github/workflows/update_copyright.yml
@@ -29,7 +29,7 @@ jobs:
     steps:
 
       - name: Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
 
       - name: Configure git
         uses: cylc/release-actions/configure-git@v1