diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1f62a1d4d9..b01c3ebd80 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -16,7 +16,7 @@ jobs:
       contents: write
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           token: ${{ secrets.USERSTYLES_TOKEN }}
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1ac3221f09..855c0ba195 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,7 +15,7 @@ jobs:
     # Prevent infinite loops by checking if the last commit was autogenerated.
     if: ${{ github.repository == 'catppuccin/userstyles' && github.event.commits[0].author.name != 'github-actions' }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           token: ${{ secrets.USERSTYLES_TOKEN }}
           fetch-depth: 2
diff --git a/.github/workflows/deno-check.yml b/.github/workflows/deno-check.yml
index fab09078df..f8b4bf6d04 100644
--- a/.github/workflows/deno-check.yml
+++ b/.github/workflows/deno-check.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup Deno
         uses: nekowinston/setup-deno@main
diff --git a/.github/workflows/deno-lock.yml b/.github/workflows/deno-lock.yml
index d4772b37a5..2010098987 100644
--- a/.github/workflows/deno-lock.yml
+++ b/.github/workflows/deno-lock.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           ref: ${{ github.event.pull_request.head.ref }}
 
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 1c529260de..183deb8c3e 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -16,7 +16,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: Build & Upload Site
         uses: withastro/action@v4
         with:
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index c032d9bc0f..0fbea745b5 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup Deno
         uses: nekowinston/setup-deno@main
diff --git a/.github/workflows/maintainers.yml b/.github/workflows/maintainers.yml
index c7f349002f..58024ea108 100644
--- a/.github/workflows/maintainers.yml
+++ b/.github/workflows/maintainers.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup Deno
         uses: nekowinston/setup-deno@main
diff --git a/.github/workflows/pull-requests.yml b/.github/workflows/pull-requests.yml
index c5150b1c45..ea86f8b0a8 100644
--- a/.github/workflows/pull-requests.yml
+++ b/.github/workflows/pull-requests.yml
@@ -9,7 +9,7 @@ jobs:
     if: ${{ !contains(github.event.pull_request.title, '(tree-wide)') && !contains(github.event.pull_request.title, '(treewide)') }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Add pull request labels
         uses: actions/labeler@v4.3.0