diff --git a/.github/workflows/chart-manual.yml b/.github/workflows/chart-manual.yml
index a8cf79cc..51124b60 100644
--- a/.github/workflows/chart-manual.yml
+++ b/.github/workflows/chart-manual.yml
@@ -33,7 +33,7 @@ jobs:
           git config --global --add safe.directory /__w/portefaix-hub/portefaix-hub
 
       - name: Checkout
-        uses: actions/checkout@v3.6.0
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/chart-publish.yml b/.github/workflows/chart-publish.yml
index 4176c6f7..ff438006 100644
--- a/.github/workflows/chart-publish.yml
+++ b/.github/workflows/chart-publish.yml
@@ -31,7 +31,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3.6.0
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/chart-release.yml b/.github/workflows/chart-release.yml
index c266bd64..ee66546f 100644
--- a/.github/workflows/chart-release.yml
+++ b/.github/workflows/chart-release.yml
@@ -44,7 +44,7 @@ jobs:
           git config --global --add safe.directory /__w/portefaix-hub/portefaix-hub
 
       - name: Checkout
-        uses: actions/checkout@v3.6.0
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
         with:
           fetch-depth: 0
 
@@ -178,7 +178,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3.6.0
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
         with:
           ref: "gh-pages"
           fetch-depth: 0
@@ -205,7 +205,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3.6.0
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
         with:
           ref: "gh-pages"
           fetch-depth: 0
diff --git a/.github/workflows/chart-test.yml b/.github/workflows/chart-test.yml
index 91a2c2c6..e0f4a575 100644
--- a/.github/workflows/chart-test.yml
+++ b/.github/workflows/chart-test.yml
@@ -43,7 +43,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3.6.0
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
 
       - name: Fetch history
         run: git fetch --prune --unshallow
@@ -114,7 +114,7 @@ jobs:
           - v1.25.0
     steps:
       - name: Checkout
-        uses: actions/checkout@v3.6.0
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/chart-validate.yml b/.github/workflows/chart-validate.yml
index 500db8e7..c69d614d 100644
--- a/.github/workflows/chart-validate.yml
+++ b/.github/workflows/chart-validate.yml
@@ -40,7 +40,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3.6.0
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
 
       - name: Validate
         uses: nlamirault/helm-kubeconform-action@v0.2.0
diff --git a/.github/workflows/chart-website.yml b/.github/workflows/chart-website.yml
index 31d35eca..14660d32 100644
--- a/.github/workflows/chart-website.yml
+++ b/.github/workflows/chart-website.yml
@@ -29,7 +29,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3.6.0
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
         with:
           ref: "gh-pages"
           fetch-depth: 0
diff --git a/.github/workflows/charts-mixins.yml b/.github/workflows/charts-mixins.yml
index fdac3a51..777500d7 100644
--- a/.github/workflows/charts-mixins.yml
+++ b/.github/workflows/charts-mixins.yml
@@ -49,7 +49,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v3.6.0
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
 
     - uses: actions/setup-python@v4.7.0
       with:
@@ -109,7 +109,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v3.6.0
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
 
     - uses: actions/setup-python@v4.7.0
       with:
@@ -169,7 +169,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v3.6.0
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
 
     - uses: actions/setup-python@v4.7.0
       with:
@@ -229,7 +229,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v3.6.0
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
 
     - uses: actions/setup-python@v4.7.0
       with:
@@ -289,7 +289,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v3.6.0
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
 
     - uses: actions/setup-python@v4.7.0
       with:
@@ -349,7 +349,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v3.6.0
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
 
     - uses: actions/setup-python@v4.7.0
       with:
@@ -409,7 +409,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v3.6.0
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
 
     - uses: actions/setup-python@v4.7.0
       with:
@@ -469,7 +469,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v3.6.0
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
 
     - uses: actions/setup-python@v4.7.0
       with:
@@ -529,7 +529,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v3.6.0
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
 
     - uses: actions/setup-python@v4.7.0
       with:
@@ -589,7 +589,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v3.6.0
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
 
     - uses: actions/setup-python@v4.7.0
       with:
@@ -649,7 +649,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v3.6.0
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
 
     - uses: actions/setup-python@v4.7.0
       with:
@@ -709,7 +709,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v3.6.0
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
 
     - uses: actions/setup-python@v4.7.0
       with:
@@ -769,7 +769,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v3.6.0
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
 
     - uses: actions/setup-python@v4.7.0
       with:
@@ -829,7 +829,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v3.6.0
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
 
     - uses: actions/setup-python@v4.7.0
       with:
@@ -889,7 +889,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v3.6.0
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
 
     - uses: actions/setup-python@v4.7.0
       with:
@@ -949,7 +949,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v3.6.0
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
 
     - uses: actions/setup-python@v4.7.0
       with:
@@ -1009,7 +1009,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v3.6.0
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
 
     - uses: actions/setup-python@v4.7.0
       with:
@@ -1069,7 +1069,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v3.6.0
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
 
     - uses: actions/setup-python@v4.7.0
       with:
diff --git a/.github/workflows/charts-policies.yml b/.github/workflows/charts-policies.yml
index 334de995..9e8b80e8 100644
--- a/.github/workflows/charts-policies.yml
+++ b/.github/workflows/charts-policies.yml
@@ -46,7 +46,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v3.6.0
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
 
     - uses: actions/setup-python@v4.7.0
       with:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 2663daab..8e07b2be 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -46,7 +46,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
diff --git a/.github/workflows/issues-label.yml b/.github/workflows/issues-label.yml
index 0fb66773..8043f113 100644
--- a/.github/workflows/issues-label.yml
+++ b/.github/workflows/issues-label.yml
@@ -31,7 +31,7 @@ jobs:
   comment:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v3.6.0
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
 
       - name: Label Commenter
         uses: peaceiris/actions-label-commenter@v1
diff --git a/.github/workflows/rebase.yml b/.github/workflows/rebase.yml
index 8e22dca9..8b9f881e 100644
--- a/.github/workflows/rebase.yml
+++ b/.github/workflows/rebase.yml
@@ -31,7 +31,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the latest code
-        uses: actions/checkout@v3.6.0
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           fetch-depth: 0 # otherwise, you will fail to push refs to dest repo
diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml
index 7e01aae5..278ef87f 100644
--- a/.github/workflows/renovate.yml
+++ b/.github/workflows/renovate.yml
@@ -31,7 +31,7 @@ jobs:
       pull-requests: write  # for peter-evans/create-pull-request to create a PR
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3.6.0
+    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
       with:
         fetch-depth: 1
 
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
index 4f06ecd6..8019d55e 100644
--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -36,7 +36,7 @@ jobs:
           egress-policy: audit
 
       - name: "Checkout code"
-        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/size.yaml b/.github/workflows/size.yaml
index fd335201..faed8dba 100644
--- a/.github/workflows/size.yaml
+++ b/.github/workflows/size.yaml
@@ -24,7 +24,7 @@ jobs:
   update_labels:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3.6.0
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
 
       - uses: actions-ecosystem/action-size@v2
         id: size
diff --git a/.github/workflows/test-sigstore-gpg.yml b/.github/workflows/test-sigstore-gpg.yml
index 2a3ca009..292ad7c7 100644
--- a/.github/workflows/test-sigstore-gpg.yml
+++ b/.github/workflows/test-sigstore-gpg.yml
@@ -32,7 +32,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3.6.0
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
         with:
           fetch-depth: 0