diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml
index 71a330d03..0b59a5918 100644
--- a/.github/workflows/codespell.yml
+++ b/.github/workflows/codespell.yml
@@ -14,7 +14,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6.0.0
       - name: Codespell
         uses: codespell-project/actions-codespell@v2
         with:
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 60f4834e0..9b35215fe 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -41,7 +41,7 @@ jobs:
       # Update by consulting: https://github.com/actions/checkout/releases
       # We include the hash after '@', and comment "pin @SIMPLE-NAME"; this is
       # the naming convention of https://github.com/mheap/pin-github-action
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # pin @v4.1
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # pin @v4.1
 
       # Runs a single command using the runners shell
       - name: Run a one-line script
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index a20aa7e19..2acbe8484 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -32,7 +32,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           persist-credentials: false