diff --git a/.github/workflows/build-and-check.yml b/.github/workflows/build-and-check.yml
index ba5ae4a6..5c07a58e 100644
--- a/.github/workflows/build-and-check.yml
+++ b/.github/workflows/build-and-check.yml
@@ -27,7 +27,7 @@ jobs:
         java_version: ${{ fromJson(needs.build-jvm-matrix.outputs.version_matrix) }}
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.2.2
       - name: configure windows pagefile
         if: ${{ matrix.os  == 'windows-latest' }}
         uses: al-cheb/configure-pagefile-action@v1.4
@@ -95,7 +95,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.2.2
       - name: set up JDK 11
         uses: actions/setup-java@v4
         with:
@@ -133,7 +133,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     needs: build
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.2.2
       - name: set up JDK 1.8
         uses: actions/setup-java@v4
         with:
diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml
index a2bba44f..c53fc742 100644
--- a/.github/workflows/changelog.yml
+++ b/.github/workflows/changelog.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.2.2
 
       - name: Grep CHANGES.md for PR number
         if: contains(github.event.pull_request.labels.*.name, 'skip news') != true
diff --git a/.github/workflows/gradle-wrapper-validation.yml b/.github/workflows/gradle-wrapper-validation.yml
index ed6c9bb3..1677bb48 100644
--- a/.github/workflows/gradle-wrapper-validation.yml
+++ b/.github/workflows/gradle-wrapper-validation.yml
@@ -6,7 +6,7 @@ jobs:
     name: "Validation"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.2.2
       - uses: gradle/wrapper-validation-action@v3
         with:
           min-wrapper-count: 2
diff --git a/.github/workflows/new-release.yml b/.github/workflows/new-release.yml
index c05d80c9..a7d70eb5 100644
--- a/.github/workflows/new-release.yml
+++ b/.github/workflows/new-release.yml
@@ -9,7 +9,7 @@ jobs:
     name: "Releasing plugin"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.2.2
       - name: set up JDK 1.8
         uses: actions/setup-java@v4
         with:
diff --git a/.github/workflows/perform-release.yaml b/.github/workflows/perform-release.yaml
index 3fd204c7..d9e51632 100644
--- a/.github/workflows/perform-release.yaml
+++ b/.github/workflows/perform-release.yaml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.2.2
         with:
           token: ${{ secrets.PAT }}
       - name: Update Changelog
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 5e136c29..43a5529e 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -32,7 +32,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
+        uses: actions/checkout@cbb722410c2e876e24abbe8de2cc27693e501dcb # v2.7.0
         with:
           persist-credentials: false