diff --git a/.github/workflows/lints.yaml b/.github/workflows/lints.yaml
index 11281ae8..c6eb8b9c 100644
--- a/.github/workflows/lints.yaml
+++ b/.github/workflows/lints.yaml
@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout project code
-        uses: actions/checkout@v3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - name: check for replace lines in go.mod files
         run: |
           ! egrep --invert-match -e '^replace.*/api => \./api|^replace.*//allow-merging$'  `find . -name 'go.mod'` | egrep -e 'go.mod:replace'
diff --git a/.github/workflows/release-keystone-operator.yaml b/.github/workflows/release-keystone-operator.yaml
index dd745536..178dde7a 100644
--- a/.github/workflows/release-keystone-operator.yaml
+++ b/.github/workflows/release-keystone-operator.yaml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
     - name: Tag image
       uses: tinact/docker.image-retag@1.0.2