diff --git a/.github/workflows/devcontainer-docker-image.yml b/.github/workflows/devcontainer-docker-image.yml
index b781ac5687..e8faa136c0 100644
--- a/.github/workflows/devcontainer-docker-image.yml
+++ b/.github/workflows/devcontainer-docker-image.yml
@@ -19,7 +19,7 @@ jobs:
 
     steps:
     - name: Checkout source
-      uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
 
     - name: Setup Docker buildx
       uses: docker/setup-buildx-action@v2.10.0
diff --git a/.github/workflows/dispatched_pre-commit.yml b/.github/workflows/dispatched_pre-commit.yml
index db9ad0679d..df94a51891 100644
--- a/.github/workflows/dispatched_pre-commit.yml
+++ b/.github/workflows/dispatched_pre-commit.yml
@@ -7,7 +7,7 @@ jobs:
   runPreCommit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
         with:
           repository: ${{github.event.client_payload.pull_request.head.repo.full_name}}
           ref: ${{github.event.client_payload.pull_request.head.ref}}
diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
index 9cc0cab83c..645ac58732 100644
--- a/.github/workflows/docker-image.yml
+++ b/.github/workflows/docker-image.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
 
       - name: Login to Docker Hub
         uses: docker/login-action@v2
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 8cb0c909f2..32c25990d1 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -11,7 +11,7 @@ jobs:
     env:
       SKIP: no-commit-to-branch
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
     - uses: actions/setup-python@v4
     - uses: pre-commit/action@v3.0.0
   mypy:
@@ -20,7 +20,7 @@ jobs:
       run:
         shell: bash -l {0}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
       - name: Cache conda
         uses: actions/cache@v3
         env:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index da535dfa45..8e7e595f01 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,7 +11,7 @@ jobs:
     env:
       PYPI_TOKEN: ${{ secrets.PYPI_TOKEN_PYMC }}
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
     - name: Set up Python
       uses: actions/setup-python@v4
       with:
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 00976e52ec..a5ea137e49 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -24,7 +24,7 @@ jobs:
     outputs:
       changes: ${{ steps.changes.outputs.src }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
         with:
           fetch-depth: 0
       - uses: dorny/paths-filter@v2
@@ -129,7 +129,7 @@ jobs:
       run:
         shell: bash -l {0}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
       - name: Cache conda
         uses: actions/cache@v3
         env:
@@ -203,7 +203,7 @@ jobs:
       run:
         shell: cmd
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
       - name: Cache conda
         uses: actions/cache@v3
         env:
@@ -286,7 +286,7 @@ jobs:
       run:
         shell: bash -l {0}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
       - name: Cache conda
         uses: actions/cache@v3
         env:
@@ -354,7 +354,7 @@ jobs:
       run:
         shell: bash -l {0}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
       - name: Cache conda
         uses: actions/cache@v3
         env:
@@ -427,7 +427,7 @@ jobs:
       run:
         shell: cmd
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
       - name: Cache conda
         uses: actions/cache@v3
         env: