diff --git a/.github/workflows/charts-changelog.yaml b/.github/workflows/charts-changelog.yaml
index 109cad1..10a8c25 100644
--- a/.github/workflows/charts-changelog.yaml
+++ b/.github/workflows/charts-changelog.yaml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         with:
           fetch-depth: 0
 
@@ -46,7 +46,7 @@ jobs:
       commitHash: ${{ steps.save-commit-hash.outputs.commit_hash }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/charts-lint.yaml b/.github/workflows/charts-lint.yaml
index 85c0b6f..a89ad74 100644
--- a/.github/workflows/charts-lint.yaml
+++ b/.github/workflows/charts-lint.yaml
@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         with:
           fetch-depth: 0
           ref: ${{ inputs.checkoutCommit }}
diff --git a/.github/workflows/charts-release-ghpages.yaml b/.github/workflows/charts-release-ghpages.yaml
index bd814da..d2b5a5d 100644
--- a/.github/workflows/charts-release-ghpages.yaml
+++ b/.github/workflows/charts-release-ghpages.yaml
@@ -24,14 +24,14 @@ jobs:
         run: export OPENSSL_CONF=/dev/null
 
       - name: Checkout charts branch
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           path: "src"
           fetch-depth: 0
 
       - name: Checkout gh-pages branch
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         with:
           token: ${{ secrets.GITHUB_TOKEN}}
           path: "dest"
diff --git a/.github/workflows/charts-release.yaml b/.github/workflows/charts-release.yaml
index d261467..5e096a9 100644
--- a/.github/workflows/charts-release.yaml
+++ b/.github/workflows/charts-release.yaml
@@ -29,7 +29,7 @@ jobs:
       charts-to-release: ${{ steps.collect-charts.outputs.charts }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/pr-metadata.yaml b/.github/workflows/pr-metadata.yaml
index 2cdcb1d..12d28b1 100644
--- a/.github/workflows/pr-metadata.yaml
+++ b/.github/workflows/pr-metadata.yaml
@@ -59,7 +59,7 @@ jobs:
       chartsToInstall: ${{ steps.changed-charts.outputs.chartsToInstall }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         with:
           fetch-depth: 0