diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index d17b4fcc5..7679ab7c3 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -23,7 +23,7 @@ jobs:
         OS: ${{ matrix.os }}
         NODE_VERSION: ${{ matrix.node }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v4
       - run: git fetch --prune --unshallow
       - run: git config --global user.name 'Actions'
       - run: git config --global user.email 'dummy@example.org'
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index c3ffddc2b..e777ee6b0 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -15,7 +15,7 @@ jobs:
           release-type: node
           package-name: commit-and-tag-version
       # The logic below handles the npm publication:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v4
         # these if statements ensure that a publication only occurs when
         # a new release is created:
         if: ${{ steps.release.outputs.release_created }}