diff --git a/.github/workflows/actionlint.yaml b/.github/workflows/actionlint.yaml
index cafe414..b406323 100644
--- a/.github/workflows/actionlint.yaml
+++ b/.github/workflows/actionlint.yaml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     name: lint github workflows
     steps:
-      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
       - name: Add problem matchers
         run: |
           # https://github.com/rhysd/actionlint/blob/3a2f2c7/docs/usage.md#problem-matchers
diff --git a/.github/workflows/create-release-prs.yaml b/.github/workflows/create-release-prs.yaml
index 73d8ccf..e00eb9b 100644
--- a/.github/workflows/create-release-prs.yaml
+++ b/.github/workflows/create-release-prs.yaml
@@ -19,7 +19,7 @@ jobs:
           config-file: .github/release-please/config.json
           manifest-file: .github/release-please/manifest.json
         id: release-please
-      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
         if: ${{ steps.release-please.outputs.prs_created == 'true' }}
       - name: Set PRs to auto-merge
         if: ${{ steps.release-please.outputs.prs_created == 'true' }}
diff --git a/.github/workflows/update-codeowners.yaml b/.github/workflows/update-codeowners.yaml
index 6e634ca..ae5ccd6 100644
--- a/.github/workflows/update-codeowners.yaml
+++ b/.github/workflows/update-codeowners.yaml
@@ -12,7 +12,7 @@ jobs:
   generateCodeowners:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
 
       - name: generate CODEOWNERS
         run: ./.github/scripts/sync-codeowners.sh > .github/CODEOWNERS