diff --git a/.github/workflows/require-version-label.yml b/.github/workflows/require-version-label.yml
index ae8b784..c767ad5 100644
--- a/.github/workflows/require-version-label.yml
+++ b/.github/workflows/require-version-label.yml
@@ -11,7 +11,7 @@ jobs:
     outputs:
       has_plugin_changes: ${{ steps.check.outputs.has_changes }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/version-bump.yml b/.github/workflows/version-bump.yml
index 04a37dd..d37606f 100644
--- a/.github/workflows/version-bump.yml
+++ b/.github/workflows/version-bump.yml
@@ -10,7 +10,7 @@ jobs:
     if: startsWith(github.event.label.name, 'bump:')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           ref: ${{ github.head_ref }}