diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 07e4401..a316c88 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -14,7 +14,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
-      - uses: actions/cache@v3
+      - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: |
             ~/.cache/pip
@@ -74,7 +74,7 @@ jobs:
           # on older versions (e.g. 3.5) that do not have pypi.org CA certs in
           # baseline pip's chain
           PIP_CERT: /etc/ssl/certs/ca-certificates.crt
-      - uses: actions/cache@v3
+      - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: |
             ~/.cache/pip