diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 20b54dfc1..473b491f3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -45,7 +45,7 @@ jobs:
 
         steps:
           - name: Checkout source code
-            uses: actions/checkout@v6
+            uses: actions/checkout@v6.0.2
             with:
               fetch-depth: 10
               persist-credentials: false
@@ -73,7 +73,7 @@ jobs:
             CFLAGS: -funsigned-char
         steps:
           - name: Checkout source code
-            uses: actions/checkout@v6
+            uses: actions/checkout@v6.0.2
             with:
               fetch-depth: 0  # needed for :commit: docs role
               persist-credentials: false
@@ -145,7 +145,7 @@ jobs:
             KITTY_BUNDLE: 1
         steps:
           - name: Checkout source code
-            uses: actions/checkout@v6
+            uses: actions/checkout@v6.0.2
             with:
               fetch-depth: 10
               persist-credentials: false
@@ -166,7 +166,7 @@ jobs:
         runs-on: macos-latest
         steps:
           - name: Checkout source code
-            uses: actions/checkout@v6
+            uses: actions/checkout@v6.0.2
             with:
               fetch-depth: 0  # needed for :commit: docs role
               persist-credentials: false
@@ -204,7 +204,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
           - name: Checkout source code
-            uses: actions/checkout@v6
+            uses: actions/checkout@v6.0.2
             with:
               fetch-depth: 10
               persist-credentials: false
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index e3074aeb8..36bfbaa3e 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -39,7 +39,7 @@ jobs:
         steps:
 
         - name: Checkout repository
-          uses: actions/checkout@v6
+          uses: actions/checkout@v6.0.2
           with:
               # We must fetch at least the immediate parents so that if this is
               # a pull request then we can checkout the head.
diff --git a/.github/workflows/depscan.yml b/.github/workflows/depscan.yml
index f25c33a75..80796866b 100644
--- a/.github/workflows/depscan.yml
+++ b/.github/workflows/depscan.yml
@@ -22,13 +22,13 @@ jobs:
             KITTY_BUNDLE: 1
         steps:
           - name: Checkout source code
-            uses: actions/checkout@v6
+            uses: actions/checkout@v6.0.2
             with:
               fetch-depth: 10
               persist-credentials: false
 
           - name: Checkout bypy
-            uses: actions/checkout@v6
+            uses: actions/checkout@v6.0.2
             with:
               fetch-depth: 1
               persist-credentials: false