diff --git a/docs/md/melange_bump.md b/docs/md/melange_bump.md
index 9ab5e92a7..6e4c07a0b 100644
--- a/docs/md/melange_bump.md
+++ b/docs/md/melange_bump.md
@@ -28,7 +28,8 @@ melange bump [flags]
 ### Options
 
 ```
-  -h, --help   help for bump
+      --expected-commit string   optional flag to update the expected-commit value of a git-checkout pipeline
+  -h, --help                     help for bump
 ```
 
 ### SEE ALSO
diff --git a/pkg/cli/bump.go b/pkg/cli/bump.go
index 16aaadb93..344a2fb78 100644
--- a/pkg/cli/bump.go
+++ b/pkg/cli/bump.go
@@ -25,6 +25,7 @@ import (
 )
 
 func Bump() *cobra.Command {
+	var expectedCommit string
 	cmd := &cobra.Command{
 		Use:     "bump",
 		Short:   "Update a Melange YAML file to reflect a new package version",
@@ -39,6 +40,7 @@ func Bump() *cobra.Command {
 
 			bumpRenovator := bump.New(
 				bump.WithTargetVersion(args[1]),
+				bump.WithExpectedCommit(expectedCommit),
 			)
 
 			if err := ctx.Renovate(bumpRenovator); err != nil {
@@ -48,6 +50,6 @@ func Bump() *cobra.Command {
 			return nil
 		},
 	}
-
+	cmd.Flags().StringVar(&expectedCommit, "expected-commit", "", "optional flag to update the expected-commit value of a git-checkout pipeline")
 	return cmd
 }
diff --git a/pkg/renovate/bump/bump.go b/pkg/renovate/bump/bump.go
index f99b359b3..e1037d30d 100644
--- a/pkg/renovate/bump/bump.go
+++ b/pkg/renovate/bump/bump.go
@@ -32,7 +32,8 @@ import (
 // BumpConfig contains the configuration data for a bump
 // renovator.
 type BumpConfig struct {
-	TargetVersion string
+	TargetVersion  string
+	ExpectedCommit string
 }
 
 // Option sets a config option on a BumpConfig.
@@ -47,6 +48,15 @@ func WithTargetVersion(targetVersion string) Option {
 	}
 }
 
+// WithExpectedCommit sets the desired target expected commit for the
+// bump renovator.
+func WithExpectedCommit(expectedCommit string) Option {
+	return func(cfg *BumpConfig) error {
+		cfg.ExpectedCommit = expectedCommit
+		return nil
+	}
+}
+
 // New returns a renovator which performs a version bump.
 func New(opts ...Option) renovate.Renovator {
 	bcfg := BumpConfig{}
@@ -99,6 +109,16 @@ func New(opts ...Option) renovate.Renovator {
 			}
 		}
 
+		// Look for git-checkout nodes.
+		it = yit.FromNode(pipelineNode).
+			RecurseNodes().
+			Filter(yit.WithMapValue("git-checkout"))
+
+		for gitCheckoutNode, ok := it(); ok; gitCheckoutNode, ok = it() {
+			if err := updateGitCheckout(gitCheckoutNode, bcfg.ExpectedCommit); err != nil {
+				return err
+			}
+		}
 		return nil
 	}
 }
@@ -155,3 +175,24 @@ func updateFetch(node *yaml.Node, targetVersion string) error {
 
 	return nil
 }
+
+// updateGitCheckout takes a "git-checkout" pipeline node and updates the parameters of it.
+func updateGitCheckout(node *yaml.Node, expectedGitSha string) error {
+	withNode, err := renovate.NodeFromMapping(node, "with")
+	if err != nil {
+		return err
+	}
+
+	log.Printf("processing git-checkout node")
+
+	if expectedGitSha != "" {
+		// Update expected hash nodes.
+		nodeCommit, err := renovate.NodeFromMapping(withNode, "expected-commit")
+		if err == nil {
+			nodeCommit.Value = expectedGitSha
+			log.Printf("  expected-commit: %s", expectedGitSha)
+		}
+	}
+
+	return nil
+}
diff --git a/pkg/renovate/bump/bump_test.go b/pkg/renovate/bump/bump_test.go
index a9d781595..523b67387 100644
--- a/pkg/renovate/bump/bump_test.go
+++ b/pkg/renovate/bump/bump_test.go
@@ -1,6 +1,7 @@
 package bump
 
 import (
+	"chainguard.dev/melange/pkg/build"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -61,6 +62,47 @@ func TestBump_versions(t *testing.T) {
 
 }
 
+func TestBump_withExpectedCommit(t *testing.T) {
+
+	dir := t.TempDir()
+
+	tests := []struct {
+		name           string
+		newVersion     string
+		expectedCommit string
+	}{
+		{name: "expected_commit.yaml", newVersion: "7.0.1", expectedCommit: "dbd7bc96fd6cd383b8e895dc4a928d808541bb17"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+
+			data, err := os.ReadFile(filepath.Join("testdata", tt.name))
+			assert.NoError(t, err)
+
+			// write the modified melange config to our working temp folder
+			err = os.WriteFile(filepath.Join(dir, tt.name), data, 0755)
+			assert.NoError(t, err)
+
+			ctx, err := renovate.New(renovate.WithConfig(filepath.Join(dir, tt.name)))
+			assert.NoError(t, err)
+
+			bumpRenovator := New(
+				WithTargetVersion(tt.newVersion),
+				WithExpectedCommit(tt.expectedCommit),
+			)
+
+			err = ctx.Renovate(bumpRenovator)
+			assert.NoError(t, err)
+
+			rs, err := build.ParseConfiguration(filepath.Join(dir, tt.name))
+			assert.NoError(t, err)
+			assert.Contains(t, rs.Package.Version, tt.newVersion)
+			assert.Contains(t, rs.Pipeline[0].With["expected-commit"], tt.expectedCommit)
+
+		})
+	}
+
+}
 func setupTestServer(t *testing.T) (error, *httptest.Server) {
 	packageData, err := os.ReadFile(filepath.Join("testdata", "cheese-7.0.1.tar.gz"))
 	assert.NoError(t, err)
diff --git a/pkg/renovate/bump/testdata/expected_commit.yaml b/pkg/renovate/bump/testdata/expected_commit.yaml
new file mode 100644
index 000000000..149b244a9
--- /dev/null
+++ b/pkg/renovate/bump/testdata/expected_commit.yaml
@@ -0,0 +1,11 @@
+package:
+  name: cheese
+  version: 6.8
+  epoch: 2
+  description: "a cheesy library"
+
+pipeline:
+  - uses: git-checkout
+    with:
+      repository: cheese/crisps
+      expected-commit: dbd7bc96fd6cd383b8e895dc4a928d808541bb17