diff --git a/.github/workflows/cd-ansible.yml b/.github/workflows/cd-ansible.yml
index 2b2b0949..c9caf948 100644
--- a/.github/workflows/cd-ansible.yml
+++ b/.github/workflows/cd-ansible.yml
@@ -80,7 +80,7 @@ jobs:
     steps:
 
     - name: Checkout actions
-      uses: actions/checkout@v3
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       with:
         repository: signalwire/actions-template
         ref: main
diff --git a/.github/workflows/cd-centos-packages.yml b/.github/workflows/cd-centos-packages.yml
index a933d790..e6e53e23 100644
--- a/.github/workflows/cd-centos-packages.yml
+++ b/.github/workflows/cd-centos-packages.yml
@@ -69,12 +69,12 @@ jobs:
     environment: ${{ inputs.ENVIRONMENT }}
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       with:
         fetch-depth: 0
 
     - name: Checkout actions
-      uses: actions/checkout@v3
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       with:
         repository: signalwire/actions-template
         ref: main
diff --git a/.github/workflows/cd-cloud-run.yml b/.github/workflows/cd-cloud-run.yml
index 6f5e9ca3..f35cef96 100644
--- a/.github/workflows/cd-cloud-run.yml
+++ b/.github/workflows/cd-cloud-run.yml
@@ -34,12 +34,12 @@ jobs:
 
     steps:
       - name: 'Checkout'
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         with:
           fetch-depth: 0
 
       - name: Checkout actions
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         with:
           repository: signalwire/actions-template
           ref: main
diff --git a/.github/workflows/cd-deb-syncchangelog.yml b/.github/workflows/cd-deb-syncchangelog.yml
index 3b763d9d..8ebaff34 100644
--- a/.github/workflows/cd-deb-syncchangelog.yml
+++ b/.github/workflows/cd-deb-syncchangelog.yml
@@ -35,13 +35,13 @@ jobs:
     environment: ${{ inputs.ENVIRONMENT }}
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       with:
         fetch-depth: 0
         token: ${{ secrets.PAT }}
     
     - name: Checkout actions
-      uses: actions/checkout@v3
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       with:
         repository: signalwire/actions-template
         ref: main
diff --git a/.github/workflows/cd-kubernetes-deploy.yml b/.github/workflows/cd-kubernetes-deploy.yml
index 5556c258..dd9ad465 100644
--- a/.github/workflows/cd-kubernetes-deploy.yml
+++ b/.github/workflows/cd-kubernetes-deploy.yml
@@ -72,12 +72,12 @@ jobs:
     environment: ${{ inputs.ENVIRONMENT }}
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       with:
         fetch-depth: 0
 
     - name: Checkout actions
-      uses: actions/checkout@v3
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       with:
         repository: signalwire/actions-template
         ref: main
diff --git a/.github/workflows/cd-libs-metadata.yml b/.github/workflows/cd-libs-metadata.yml
index 4bcb8097..fc64bcac 100644
--- a/.github/workflows/cd-libs-metadata.yml
+++ b/.github/workflows/cd-libs-metadata.yml
@@ -66,7 +66,7 @@ jobs:
 
     steps:
       - name: Checkout metadatarepo
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         continue-on-error: true
         id: metabranch
         with:
@@ -76,7 +76,7 @@ jobs:
           token: ${{ secrets.GH_BOT_DEPLOY_TOKEN || github.token }}
       
       - name: Checkout metadatarepo
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         if: steps.metabranch.outcome != 'success'
         with:
           repository: ${{ inputs.TARGET_REPO }}
diff --git a/.github/workflows/cd-retag.yml b/.github/workflows/cd-retag.yml
index a1809d3b..e0fb6992 100644
--- a/.github/workflows/cd-retag.yml
+++ b/.github/workflows/cd-retag.yml
@@ -49,7 +49,7 @@ jobs:
     steps:
 
     - name: Checkout actions
-      uses: actions/checkout@v3
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       with:
         repository: signalwire/actions-template
         ref: main
diff --git a/.github/workflows/cd-rpm-packages.yml b/.github/workflows/cd-rpm-packages.yml
index d9c8258c..9deb8a71 100644
--- a/.github/workflows/cd-rpm-packages.yml
+++ b/.github/workflows/cd-rpm-packages.yml
@@ -52,12 +52,12 @@ jobs:
     permissions: write-all
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       with:
         fetch-depth: 0
 
     - name: Checkout actions
-      uses: actions/checkout@v3
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       with:
         repository: signalwire/actions-template
         ref: main
diff --git a/.github/workflows/cd-scp.yml b/.github/workflows/cd-scp.yml
index 224731cc..0888cc07 100644
--- a/.github/workflows/cd-scp.yml
+++ b/.github/workflows/cd-scp.yml
@@ -65,7 +65,7 @@ jobs:
 
     steps:
     - name: Checkout actions
-      uses: actions/checkout@v3
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       with:
         repository: signalwire/actions-template
         ref: main
diff --git a/.github/workflows/cd-swarm-deploy.yml b/.github/workflows/cd-swarm-deploy.yml
index bbf35e1e..35ff21ac 100644
--- a/.github/workflows/cd-swarm-deploy.yml
+++ b/.github/workflows/cd-swarm-deploy.yml
@@ -63,12 +63,12 @@ jobs:
     environment: ${{ inputs.ENVIRONMENT }}
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       with:
         fetch-depth: 0
 
     - name: Checkout actions
-      uses: actions/checkout@v3
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       with:
         repository: signalwire/actions-template
         ref: main
diff --git a/.github/workflows/ci-build.yml b/.github/workflows/ci-build.yml
index 3a37b7c5..b260e785 100644
--- a/.github/workflows/ci-build.yml
+++ b/.github/workflows/ci-build.yml
@@ -151,12 +151,12 @@ jobs:
       IMAGE_MATRIX: ${{ fromJson(steps.out.outputs.result).image }}
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       with:
         ref: ${{ github.event.pull_request.head.ref || github.ref }}
         fetch-depth: 0
 
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       name: Checkout private submoules recursively
       id: private
       if: ${{ inputs.SUBMODULES_RECURSIVE  == true && inputs.SUBMODULES_PRIVATE == true }}
@@ -166,7 +166,7 @@ jobs:
         token: ${{ secrets.GH_BOT_DEPLOY_TOKEN || github.token }}
         submodules: 'recursive'
 
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       name: Checkout public submoules recursively
       id: public
       if: ${{ inputs.SUBMODULES_RECURSIVE  == true && inputs.SUBMODULES_PRIVATE == false }}
@@ -180,7 +180,7 @@ jobs:
     - run: git show -s --oneline --no-abbrev-commit >> ${{inputs.REVISION_PATH}}/REVISION
 
     - name: Checkout actions
-      uses: actions/checkout@v3
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       with:
         repository: signalwire/actions-template
         ref: main 
diff --git a/.github/workflows/ci-check.yml b/.github/workflows/ci-check.yml
index 5b409f88..d864b9a4 100644
--- a/.github/workflows/ci-check.yml
+++ b/.github/workflows/ci-check.yml
@@ -108,11 +108,11 @@ jobs:
     environment: ${{ inputs.ENVIRONMENT }}
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       with:
         fetch-depth: 0
 
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       if: ${{ inputs.SUBMODULES_RECURSIVE  == true }}
       name: Checkout submodules
       with:
@@ -120,7 +120,7 @@ jobs:
         submodules: 'recursive'
 
     - name: Checkout actions
-      uses: actions/checkout@v3
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       with:
         repository: signalwire/actions-template
         ref: main
diff --git a/.github/workflows/ci-deb-packages-v2.yml b/.github/workflows/ci-deb-packages-v2.yml
index 655a293e..881aead2 100644
--- a/.github/workflows/ci-deb-packages-v2.yml
+++ b/.github/workflows/ci-deb-packages-v2.yml
@@ -40,7 +40,7 @@ jobs:
     name: Build
     environment: ${{ inputs.ENVIRONMENT }}
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       with:
         fetch-depth: 0
 
diff --git a/.github/workflows/ci-deb-packages.yml b/.github/workflows/ci-deb-packages.yml
index e353e13c..d37fc6bd 100644
--- a/.github/workflows/ci-deb-packages.yml
+++ b/.github/workflows/ci-deb-packages.yml
@@ -52,12 +52,12 @@ jobs:
     environment: ${{ inputs.ENVIRONMENT }}
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       with:
         fetch-depth: 0
 
     - name: Checkout actions
-      uses: actions/checkout@v3
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       with:
         repository: signalwire/actions-template
         ref: main
diff --git a/.github/workflows/ci-rpm-packages.yml b/.github/workflows/ci-rpm-packages.yml
index a584724c..5a35f96c 100644
--- a/.github/workflows/ci-rpm-packages.yml
+++ b/.github/workflows/ci-rpm-packages.yml
@@ -49,7 +49,7 @@ jobs:
     environment: ${{ inputs.ENVIRONMENT }}
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       with:
         fetch-depth: 0
 
diff --git a/.github/workflows/ci-tests.yml b/.github/workflows/ci-tests.yml
index 2b671d68..2b83376b 100644
--- a/.github/workflows/ci-tests.yml
+++ b/.github/workflows/ci-tests.yml
@@ -66,7 +66,7 @@ jobs:
     environment: ${{ inputs.ENVIRONMENT }}
     name: Cypress
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       with:
         fetch-depth: 0
 
@@ -75,7 +75,7 @@ jobs:
       with:
         node-version: ${{ inputs.NODE_VERSION }}
 
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       name: Checkout private submoules recursively
       id: private
       if: ${{ inputs.SUBMODULES_RECURSIVE  == true && inputs.SUBMODULES_PRIVATE == true }}
@@ -84,7 +84,7 @@ jobs:
         token: ${{ secrets.GH_BOT_DEPLOY_TOKEN || github.token }}
         submodules: 'recursive'
 
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       name: Checkout public submoules recursively
       id: public
       if: ${{ inputs.SUBMODULES_RECURSIVE  == true && inputs.SUBMODULES_PRIVATE == false }}
diff --git a/.github/workflows/helm-local.yml b/.github/workflows/helm-local.yml
index de9cae5f..e0841b12 100644
--- a/.github/workflows/helm-local.yml
+++ b/.github/workflows/helm-local.yml
@@ -47,7 +47,7 @@ jobs:
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - uses: azure/setup-helm@v3
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       - name: helm version
         run: helm version
         shell: bash
diff --git a/.github/workflows/helm-remote.yml b/.github/workflows/helm-remote.yml
index bcd789b3..308b1b9f 100644
--- a/.github/workflows/helm-remote.yml
+++ b/.github/workflows/helm-remote.yml
@@ -49,7 +49,7 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       - name: Install Helm
         uses: azure/setup-helm@v3
         with:
diff --git a/.github/workflows/iac.yml b/.github/workflows/iac.yml
index 25cfd2d9..9cb1c69e 100644
--- a/.github/workflows/iac.yml
+++ b/.github/workflows/iac.yml
@@ -85,10 +85,10 @@ jobs:
 
     steps:
       - name: 'Checkout'
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
 
       - name: Checkout actions
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         with:
           repository: signalwire/actions-template
           ref: main