diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index d355055..f2b76cc 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -11,7 +11,7 @@ jobs:
       pull-requests: write
       packages: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: "Publish Features"
         uses: devcontainers/action@v1
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 6a31212..e24c14c 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -32,7 +32,7 @@ jobs:
           - mcr.microsoft.com/devcontainers/base:debian
           - mcr.microsoft.com/devcontainers/base:ubuntu
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: "Install latest devcontainer CLI"
         run: npm install -g @devcontainers/cli
@@ -50,7 +50,7 @@ jobs:
           - clang
           - persist-shell-history
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: "Install latest devcontainer CLI"
         run: npm install -g @devcontainers/cli
@@ -62,7 +62,7 @@ jobs:
     runs-on: ubuntu-latest
     continue-on-error: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: "Install latest devcontainer CLI"
         run: npm install -g @devcontainers/cli
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index 863418e..7422a0b 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -7,7 +7,7 @@ jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: "Validate devcontainer-feature.json files"
         uses: devcontainers/action@v1