diff --git a/.github/workflows/k8s-diff.yaml b/.github/workflows/k8s-diff.yaml
index 021083d58..b1afa1356 100644
--- a/.github/workflows/k8s-diff.yaml
+++ b/.github/workflows/k8s-diff.yaml
@@ -5,7 +5,7 @@ jobs:
     name: Base
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
         with:
           ref: ${{ github.event.pull_request.base.sha }}
       - uses: bazelbuild/setup-bazelisk@v2
@@ -31,7 +31,7 @@ jobs:
     name: Head
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
       - uses: bazelbuild/setup-bazelisk@v2
       - name: Mount bazel cache
         uses: actions/cache@v3
diff --git a/.github/workflows/k8s.yaml b/.github/workflows/k8s.yaml
index da17fd22a..7602ccbad 100644
--- a/.github/workflows/k8s.yaml
+++ b/.github/workflows/k8s.yaml
@@ -7,7 +7,7 @@ jobs:
     name: Unwind
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
       - uses: tailscale/github-action@v2
         with:
           oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index d5c52512c..c62e05324 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -5,7 +5,7 @@ jobs:
     name: Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
       - uses: bazelbuild/setup-bazelisk@v2
       - name: Test
         run: |