diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 5b4b9ec..ed2f0ec 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -31,7 +31,7 @@ jobs:
     name: Test JDK ${{ matrix.java }}, ${{ matrix.os }}
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       - name: Set up JDK
         uses: actions/setup-java@v3
         with:
diff --git a/.github/workflows/sonar.yaml b/.github/workflows/sonar.yaml
index c369174..3ed158c 100644
--- a/.github/workflows/sonar.yaml
+++ b/.github/workflows/sonar.yaml
@@ -26,7 +26,7 @@ jobs:
     if: github.repository_owner == 'mybatis'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         with:
           # Disabling shallow clone is recommended for improving relevancy of reporting
           fetch-depth: 0
diff --git a/.github/workflows/sonatype.yaml b/.github/workflows/sonatype.yaml
index fa4a4a7..b05f361 100644
--- a/.github/workflows/sonatype.yaml
+++ b/.github/workflows/sonatype.yaml
@@ -26,7 +26,7 @@ jobs:
     if: github.repository_owner == 'mybatis' && ! contains(toJSON(github.event.head_commit.message), '[maven-release-plugin]')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       - name: Set up JDK
         uses: actions/setup-java@v3
         with: