diff --git a/.github/workflows/k8s-diff.yaml b/.github/workflows/k8s-diff.yaml
index fdb088dad..9d93320c8 100644
--- a/.github/workflows/k8s-diff.yaml
+++ b/.github/workflows/k8s-diff.yaml
@@ -5,7 +5,7 @@ jobs:
     name: Base
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
         with:
           ref: ${{ github.event.pull_request.base.sha }}
       - uses: cue-lang/setup-cue@v1.0.0
@@ -18,7 +18,7 @@ jobs:
     name: Head
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
       - uses: cue-lang/setup-cue@v1.0.0
       - run: cue export ./k8s/magiclove/list.cue > list.json
       - uses: actions/upload-artifact@v3
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 90972c47c..312a8fc0f 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -5,6 +5,6 @@ jobs:
     name: Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
       - uses: cue-lang/setup-cue@v1.0.0
       - run: cue export ./k8s/magiclove/list.cue