diff --git a/.gitea/workflows/lint.yml b/.gitea/workflows/lint.yml
index 692a426..1c57ace 100644
--- a/.gitea/workflows/lint.yml
+++ b/.gitea/workflows/lint.yml
@@ -11,7 +11,7 @@ jobs:
     name: PHP (phpcs PSR-12)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
 
       - name: Install PHP and phpcs
         run: |
@@ -27,7 +27,7 @@ jobs:
     name: JS (eslint)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
 
       - name: Install ESLint
         run: npm install --save-dev eslint@8
@@ -39,7 +39,7 @@ jobs:
     name: PHP requirements (version + extensions)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
 
       - name: Install PHP with required extensions
         run: |
diff --git a/.gitea/workflows/security.yml b/.gitea/workflows/security.yml
index 71b8542..8b06338 100644
--- a/.gitea/workflows/security.yml
+++ b/.gitea/workflows/security.yml
@@ -13,7 +13,7 @@ jobs:
     name: PHP Security (semgrep)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
 
       - name: Install semgrep
         run: |