diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml
index 79f9474eb8..f65b7c33d1 100644
--- a/.github/workflows/changelog.yml
+++ b/.github/workflows/changelog.yml
@@ -13,7 +13,7 @@ jobs:
 
     steps:
       - name: "Checkout repository"
-        uses: actions/checkout@b32f140b0c872d58512e0a66172253c302617b90 # v4.0.0
+        uses: actions/checkout@cd7d8d697e10461458bc61a30d094dc601a8b017 # v4.0.0
         with:
           # `towncrier check` runs `git diff --name-only origin/main...`, which
           # needs a non-shallow clone.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4522a05a37..8b6b40550f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: "Checkout repository"
-        uses: actions/checkout@b32f140b0c872d58512e0a66172253c302617b90 # v4.0.0
+        uses: actions/checkout@cd7d8d697e10461458bc61a30d094dc601a8b017 # v4.0.0
 
       - name: "Setup Python"
         uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
@@ -103,7 +103,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: "Checkout repository"
-        uses: actions/checkout@b32f140b0c872d58512e0a66172253c302617b90 # v4.0.0
+        uses: actions/checkout@cd7d8d697e10461458bc61a30d094dc601a8b017 # v4.0.0
 
       - name: "Setup Python ${{ matrix.python-version }}"
         uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
@@ -141,7 +141,7 @@ jobs:
     needs: test
     steps:
       - name: "Checkout repository"
-        uses: actions/checkout@b32f140b0c872d58512e0a66172253c302617b90 # v4.0.0
+        uses: actions/checkout@cd7d8d697e10461458bc61a30d094dc601a8b017 # v4.0.0
 
       - name: "Setup Python"
         uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 93f75b8070..753fcb22fb 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -21,7 +21,7 @@ jobs:
       security-events: write
     steps:
     - name: "Checkout repository"
-      uses: actions/checkout@b32f140b0c872d58512e0a66172253c302617b90 # v4.0.0
+      uses: actions/checkout@cd7d8d697e10461458bc61a30d094dc601a8b017 # v4.0.0
 
     - name: "Run CodeQL init"
       uses: github/codeql-action/init@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4
diff --git a/.github/workflows/downstream.yml b/.github/workflows/downstream.yml
index 81b4df056d..5b347113db 100644
--- a/.github/workflows/downstream.yml
+++ b/.github/workflows/downstream.yml
@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: "Checkout repository"
-        uses: actions/checkout@b32f140b0c872d58512e0a66172253c302617b90 # v4.0.0
+        uses: actions/checkout@cd7d8d697e10461458bc61a30d094dc601a8b017 # v4.0.0
 
       - name: "Setup Python"
         uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 420f53d54f..1c5ab1d870 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -11,7 +11,7 @@ jobs:
 
     steps:
       - name: "Checkout repository"
-        uses: actions/checkout@b32f140b0c872d58512e0a66172253c302617b90 # v4.0.0
+        uses: actions/checkout@cd7d8d697e10461458bc61a30d094dc601a8b017 # v4.0.0
 
       - name: "Setup Python"
         uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 2a2b4eb64f..4bad924ac3 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -19,7 +19,7 @@ jobs:
 
     steps:
       - name: "Checkout repository"
-        uses: actions/checkout@b32f140b0c872d58512e0a66172253c302617b90 # v4.0.0
+        uses: actions/checkout@cd7d8d697e10461458bc61a30d094dc601a8b017 # v4.0.0
 
       - name: "Setup Python"
         uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
index 4dd59be6fc..9b6daf91ef 100644
--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: "Checkout repository"
-        uses: actions/checkout@b32f140b0c872d58512e0a66172253c302617b90 # v4.0.0
+        uses: actions/checkout@cd7d8d697e10461458bc61a30d094dc601a8b017 # v4.0.0
         with:
           persist-credentials: false