diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 07e4401..4213da7 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -10,7 +10,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
@@ -61,7 +61,7 @@ jobs:
             os: ubuntu-20.04
             extra-deps: "'virtualenv<20.22.0'"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - uses: actions/setup-python@v5
         with:
           # >= 3.11 to ensure there's a recent one to run nox with
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 36f2716..8ba9709 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -23,7 +23,7 @@ jobs:
     needs: release_please
     if: needs.release_please.outputs.release_created
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           ref: ${{ needs.release_please.outputs.sha }}
       - uses: actions/setup-python@v5