diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cb2d355ba..9baf18de1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,7 +15,7 @@ jobs:
         racket-variant: ["BC", "CS"]
         enable-contracts: [true, false]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.1.7
       - uses: Bogdanp/setup-racket@v1.11
         with:
           architecture: x64
diff --git a/.github/workflows/resyntax-analyze.yml b/.github/workflows/resyntax-analyze.yml
index f070f7669..7c3f4f0e0 100644
--- a/.github/workflows/resyntax-analyze.yml
+++ b/.github/workflows/resyntax-analyze.yml
@@ -27,7 +27,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.7
         # See https://github.com/actions/checkout/issues/118.
         with:
           fetch-depth: 0
diff --git a/.github/workflows/resyntax-autofixer.yml b/.github/workflows/resyntax-autofixer.yml
index e236ab713..14b3ee673 100644
--- a/.github/workflows/resyntax-autofixer.yml
+++ b/.github/workflows/resyntax-autofixer.yml
@@ -26,7 +26,7 @@ jobs:
         env:
           GH_TOKEN: ${{ steps.generate-token.outputs.token }}
       - name: Checkout code
-        uses: actions/checkout@v3.0.2
+        uses: actions/checkout@v4.1.7
         # See https://github.com/actions/checkout/issues/118.
         with:
           fetch-depth: 0
diff --git a/.github/workflows/resyntax-submit-review.yml b/.github/workflows/resyntax-submit-review.yml
index 3569c2805..79d0465ad 100644
--- a/.github/workflows/resyntax-submit-review.yml
+++ b/.github/workflows/resyntax-submit-review.yml
@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.7
       - name: Download Resyntax analysis
         # This uses a github script instead of the download-artifact action because
         # that action doesn't work for artifacts uploaded by other workflows. See