diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ad2f2cb..6e9b384 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,7 +11,7 @@ jobs:
     if: github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'release')
     runs-on: Ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       - uses: actions/setup-node@v1
         with:
           registry-url: "https://registry.npmjs.org"
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 0da9f4c..7c5f4a8 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -27,7 +27,7 @@ jobs:
         node: [14, 16]
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       - name: Setup Node.js ${{ matrix.node }}
         uses: actions/setup-node@v3
         with: