diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 97c6e276..ee8e56bd 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -59,7 +59,7 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@v7.0.1
 
     # Add any setup steps before running the `github/codeql-action/init` action.
     # This includes steps like installing compilers or runtimes (`actions/setup-node`
diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
index 563fb89a..380d48ed 100644
--- a/.github/workflows/shellcheck.yml
+++ b/.github/workflows/shellcheck.yml
@@ -16,7 +16,7 @@ jobs:
     steps:
       - name: Checkout
         # Pinned to the v4.2.2 commit SHA (tags are mutable; a SHA is not).
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: Run shellcheck on all shell scripts
         # shellcheck is preinstalled on ubuntu-latest runners.