diff --git a/.github/workflows/setup-clients.yaml b/.github/workflows/setup-clients.yaml
index db8a98cd898..8b9ce3738cf 100644
--- a/.github/workflows/setup-clients.yaml
+++ b/.github/workflows/setup-clients.yaml
@@ -10,7 +10,7 @@ jobs:
     outputs:
       version: ${{ steps.supported-versions-matrix.outputs.lowest }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
       - id: supported-versions-matrix
         uses: WyriHaximus/github-action-composer-php-versions-in-range@v1
   set-up-clients:
@@ -26,7 +26,7 @@ jobs:
         id: current-time
         with:
           format: "YYYY/MM/DD"
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
       - uses: ramsey/composer-install@v2
       - name: Set up clients
         run: make setup-clients
diff --git a/.github/workflows/subsplit.yaml b/.github/workflows/subsplit.yaml
index 6dd603cac1c..922ccc899c3 100644
--- a/.github/workflows/subsplit.yaml
+++ b/.github/workflows/subsplit.yaml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Publish Sub-split
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           fetch-depth: '0'
           persist-credentials: 'false'