diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index b773e519b..ee54995c9 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -16,7 +16,7 @@ jobs:
         OS: ${{ matrix.os }}
         NODE_VERSION: ${{ matrix.node }}
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
       - run: git fetch --prune --unshallow
       - run: git config --global user.name 'Actions'
       - run: git config --global user.email 'dummy@example.org'
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 704907812..7fe990447 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -15,7 +15,7 @@ jobs:
           release-type: node
           package-name: commit-and-tag-version
       # The logic below handles the npm publication:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
         # these if statements ensure that a publication only occurs when
         # a new release is created:
         if: ${{ steps.release.outputs.release_created }}