diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index 052c8e0..629c8e7 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -51,7 +51,7 @@ jobs:
         shell: bash
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: refs/tags/${{ needs.prepare.outputs.tag_name }}
 
diff --git a/.github/workflows/release-binaries.yml b/.github/workflows/release-binaries.yml
index 0654da2..d740ab7 100644
--- a/.github/workflows/release-binaries.yml
+++ b/.github/workflows/release-binaries.yml
@@ -40,7 +40,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ inputs.tag || github.ref }}
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5e06920..630d3b1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -31,7 +31,7 @@ jobs:
             target: x86
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Prepare resilient maturin download for manylinux Docker
         run: |
           bin_dir="${RUNNER_TEMP}/maturin-docker-bin"
@@ -96,7 +96,7 @@ jobs:
           - runner: windows-latest
             target: x86
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Build wheels
         uses: PyO3/maturin-action@v1
         with:
@@ -118,7 +118,7 @@ jobs:
           - runner: macos-14
             target: aarch64
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Build wheels
         uses: PyO3/maturin-action@v1
         with:
@@ -133,7 +133,7 @@ jobs:
   sdist:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Build sdist
         uses: PyO3/maturin-action@v1
         with:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index d63857b..0f692e9 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -13,7 +13,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable
diff --git a/.github/workflows/update_docs..yml b/.github/workflows/update_docs..yml
index 1719611..07a6dc0 100644
--- a/.github/workflows/update_docs..yml
+++ b/.github/workflows/update_docs..yml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Run AI Docs Sync
         uses: Corgea/internal_actions/sync-docs-action@main