diff --git a/.github/actions/deploy/action.yaml b/.github/actions/deploy/action.yaml
index 53df36514f..edd9ae112d 100644
--- a/.github/actions/deploy/action.yaml
+++ b/.github/actions/deploy/action.yaml
@@ -67,7 +67,7 @@ runs:
       run: npm run compile
 
     - name: Download GitBook docs
-      uses: actions/checkout@v4
+      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
       with:
         repository: pagopa/devportal-docs
         ref: docs/from-gitbook
diff --git a/.github/workflows/move_latest_tag.yaml b/.github/workflows/move_latest_tag.yaml
index 67c4d472c5..d8f9d3724d 100644
--- a/.github/workflows/move_latest_tag.yaml
+++ b/.github/workflows/move_latest_tag.yaml
@@ -11,7 +11,7 @@ jobs:
     if: ${{ startsWith(github.ref, 'refs/tags/') && !endsWith(github.ref, '@latest') }}
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
       
     - name: Get commit hash associated with the new tag
       id: get-commit