diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 832e89d..e9ae7be 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: checkout project
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - name: setup python
         uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3
         with:
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 35b1e45..1226665 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -23,7 +23,7 @@ jobs:
       url: https://rwalk.fly.dev
     steps:
       - name: checkout project
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - name: install cosign
         uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da
       - name: verify rwalk image
diff --git a/.github/workflows/digesta.yml b/.github/workflows/digesta.yml
index ec59e6e..224fcbe 100644
--- a/.github/workflows/digesta.yml
+++ b/.github/workflows/digesta.yml
@@ -17,7 +17,7 @@ jobs:
       pull-requests: write
 
     steps:
-      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - uses: chainguard-dev/digestabot@02ea60d2aeb26664ace4a9cc2ecdbea96888aaa4
         with:
           title-for-pr: 'build(Dockerfile): bump python latest tag digest'