diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 79147359c..b819736dc 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -6,7 +6,8 @@ jobs:
   coverage:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      # v4.2.2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
 
       - name: Install Rust
         run: rustup toolchain install stable --component llvm-tools-preview
diff --git a/.github/workflows/deploy_docs.yml b/.github/workflows/deploy_docs.yml
index ef809a873..e923df8aa 100644
--- a/.github/workflows/deploy_docs.yml
+++ b/.github/workflows/deploy_docs.yml
@@ -22,7 +22,8 @@ jobs:
     if: needs.pre_deploy.outputs.should_skip != 'true'
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      # v4.2.2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
 
       - name: Install jq
         run: sudo apt-get install -y jq
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2a532693f..eed48597f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -9,7 +9,8 @@ jobs:
   create-release:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      # v4.2.2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - uses: taiki-e/create-gh-release-action@v1
         with:
           # Create a draft release so we can add the changelog before publishing it
@@ -42,7 +43,8 @@ jobs:
             os: macos-latest
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      # v4.2.2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - uses: taiki-e/upload-rust-binary-action@v1
         with:
           bin: difft
@@ -59,7 +61,8 @@ jobs:
   push_crates_io:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      # v4.2.2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - uses: katyo/publish-crates@v2
         with:
           registry-token: ${{ secrets.CARGO_REGISTRY_TOKEN }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 9b57d07e4..870a5b6e6 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -28,7 +28,8 @@ jobs:
 
     steps:
     - name: Checkout source code
-      uses: actions/checkout@v4
+      # v4.2.2
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
 
     - name: Install Rust toolchain
       uses: dtolnay/rust-toolchain@1.74.1
@@ -54,7 +55,8 @@ jobs:
     name: Test with MIME database
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      # v4.2.2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - uses: dtolnay/rust-toolchain@1.74.1
       # This runs tests that rely on the MIME database being present.
       - run: cargo test -- --ignored
@@ -63,7 +65,8 @@ jobs:
     name: Test Linux (latest stable Rust)
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      # v4.2.2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - uses: dtolnay/rust-toolchain@stable
       - run: cargo +stable test
 
@@ -71,7 +74,8 @@ jobs:
     name: Output Regression Test
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      # v4.2.2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - uses: dtolnay/rust-toolchain@1.74.1
       - name: Generate output for all sample files
         run: ./sample_files/compare_all.sh
@@ -82,7 +86,8 @@ jobs:
     name: Check Linux Packaging
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      # v4.2.2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - uses: dtolnay/rust-toolchain@1.74.1
       - run: cargo package --allow-dirty
 
@@ -90,7 +95,8 @@ jobs:
     name: Rustfmt
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      # v4.2.2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - uses: dtolnay/rust-toolchain@1.74.1
       - run: cargo fmt --all -- --check
 
@@ -98,7 +104,8 @@ jobs:
     name: Actionlint
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      # v4.2.2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - uses: raven-actions/actionlint@v2
         with:
           shellcheck: false