diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9eaaa98..02739cc 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,7 +10,7 @@ jobs:
     env:
       CC: clang
     steps:
-    - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4
+    - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4
     - uses: cgrindel/gha_set_up_bazel@v1
       with:
         repo_name: gha_join_jobs
@@ -32,7 +32,7 @@ jobs:
     needs: [ubuntu_build, another_job]
     if: ${{ always() }}
     steps:
-      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4
+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4
       - uses: ./
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/move_major_ver_tag_on_release.yml b/.github/workflows/move_major_ver_tag_on_release.yml
index 8061b7f..9c63878 100644
--- a/.github/workflows/move_major_ver_tag_on_release.yml
+++ b/.github/workflows/move_major_ver_tag_on_release.yml
@@ -18,7 +18,7 @@ jobs:
       # branches and tags. This is important if the workflow is launched via
       # workspace_dispatch event. It ensures that we can find the release tag
       # and the major version tag.
-      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4
+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4
         with:
           # Fetch all history for all branches and tags
           fetch-depth: 0
diff --git a/action.yml b/action.yml
index b26adbc..7c99d12 100644
--- a/action.yml
+++ b/action.yml
@@ -18,7 +18,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4
+    - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4
       with:
         repository: cgrindel/gha_join_jobs
         ref: ${{ inputs.checkout_ref }}