diff --git a/.github/workflows/advisory.yml b/.github/workflows/advisory.yml
index e2aedb9688..bc09f978a8 100644
--- a/.github/workflows/advisory.yml
+++ b/.github/workflows/advisory.yml
@@ -18,7 +18,7 @@ jobs:
     permissions:
       contents: read
     steps:
-    - uses: actions/checkout@1e204e9a9253d643386038d443f96446fa156a97
+    - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
     - uses: EmbarkStudios/cargo-deny-action@0ca727bbae7b7b578b9a5f98186caac35aa2a00d
       with:
         command: check advisories
@@ -43,7 +43,7 @@ jobs:
           - tls
           - transport-header
     steps:
-      - uses: actions/checkout@1e204e9a9253d643386038d443f96446fa156a97
+      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
       - run: rustup toolchain add nightly
       - run: cargo install cargo-fuzz
       # Iterate through all fuzz crates to ensure each compiles independently.
@@ -58,7 +58,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@1e204e9a9253d643386038d443f96446fa156a97
+      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
       - run: make build
         env:
           CARGO_RELEASE: true
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 7983d1266a..1788a6abdd 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -14,7 +14,7 @@ jobs:
       image: docker://rust:1.56.0-buster
       options: --security-opt seccomp=unconfined
     steps:
-      - uses: actions/checkout@1e204e9a9253d643386038d443f96446fa156a97
+      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
       - run: cargo install cargo-tarpaulin
       - run: cargo tarpaulin --verbose --workspace --out Xml
       - uses: codecov/codecov-action@f32b3a3741e1053eb607407145bc9619351dc93b
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 740538f3f7..d5a39d7dc9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -33,7 +33,7 @@ jobs:
     timeout-minutes: 40
     steps:
       - name: git co
-        uses: actions/checkout@1e204e9a9253d643386038d443f96446fa156a97
+        uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
 
       - name: meta
         id: release-tag-meta
@@ -75,7 +75,7 @@ jobs:
       contents: write
     steps:
       - name: git co
-        uses: actions/checkout@1e204e9a9253d643386038d443f96446fa156a97
+        uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
 
       - name: meta
         id: release-tag-meta
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 0abdd2abf2..aae7d51453 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -20,7 +20,7 @@ jobs:
     permissions:
       contents: read
     steps:
-    - uses: actions/checkout@1e204e9a9253d643386038d443f96446fa156a97
+    - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
     - uses: EmbarkStudios/cargo-deny-action@0ca727bbae7b7b578b9a5f98186caac35aa2a00d
       with:
         command: check bans licenses sources
@@ -34,7 +34,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@1e204e9a9253d643386038d443f96446fa156a97
+      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
       - run: rustup component add clippy
       - run: make lint
 
@@ -47,7 +47,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@1e204e9a9253d643386038d443f96446fa156a97
+      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
       - run: for d in $(for toml in $(find . -mindepth 2 -name Cargo.toml -not -path '*/fuzz/*') ; do echo ${toml%/*} ; done | sort -r ) ; do echo "# $d" ; (cd $d ; cargo check --all-targets) ; done
 
   # Enforce automated formatting.
@@ -59,7 +59,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@1e204e9a9253d643386038d443f96446fa156a97
+      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
       - run: rustup component add rustfmt
       - run: make check-fmt
 
@@ -70,7 +70,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@1e204e9a9253d643386038d443f96446fa156a97
+      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
       - run: make test
 
   # Generate docs
@@ -80,5 +80,5 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@1e204e9a9253d643386038d443f96446fa156a97
+      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
       - run: cargo doc