diff --git a/.github/workflows/debian.yml b/.github/workflows/debian.yml
index d59152a..62579fe 100644
--- a/.github/workflows/debian.yml
+++ b/.github/workflows/debian.yml
@@ -60,7 +60,7 @@ jobs:
           - ghc: '9.6.7'
             ghc_minor: '9.6'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: build + smoke test [${{ matrix.ghc }}]
         uses: nick-invision/retry@v3.0.0
         with:
@@ -71,7 +71,7 @@ jobs:
               -t haskell:${{ matrix.ghc }}-${{ matrix.deb }} \
               ${{ matrix.ghc_minor }}/${{ matrix.deb }} \
               --build-arg "BUILDKIT_DOCKERFILE_CHECK=skip=SecretsUsedInArgOrEnv;error=true"
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           repository: docker-library/official-images
           path: official-images
@@ -110,7 +110,7 @@ jobs:
             deb: 'bullseye'
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: docker build and test [arm64 ${{ matrix.ghc }}]
         run: |
           docker build --pull --progress=plain \
@@ -124,7 +124,7 @@ jobs:
           docker run \
             -t haskell:${{ matrix.ghc }}-${{ matrix.deb }} \
             bash -c "echo | ghci"
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           repository: docker-library/official-images
           path: official-images
diff --git a/.github/workflows/gen-pop-cache.yaml b/.github/workflows/gen-pop-cache.yaml
index f7cf093..dbdc60b 100644
--- a/.github/workflows/gen-pop-cache.yaml
+++ b/.github/workflows/gen-pop-cache.yaml
@@ -7,5 +7,5 @@ jobs:
   populate-cache:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ./.github/actions/build-generator
diff --git a/.github/workflows/generator.yml b/.github/workflows/generator.yml
index 92c5e90..4707963 100644
--- a/.github/workflows/generator.yml
+++ b/.github/workflows/generator.yml
@@ -15,7 +15,7 @@ jobs:
   build:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ./.github/actions/build-generator
 #        with:
 #          debug_mode: ${{ github.event.inputs.debug_mode }}
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index c888f86..a43e0be 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -12,7 +12,7 @@ jobs:
   hadolint:
     runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
     - uses: hadolint/hadolint-action@v3.1.0
       with:
         recursive: true