diff --git a/.github/workflows/dev-image.yml b/.github/workflows/dev-image.yml
index 2a27412fb..d613b1d43 100644
--- a/.github/workflows/dev-image.yml
+++ b/.github/workflows/dev-image.yml
@@ -31,7 +31,7 @@ jobs:
     runs-on: ubuntu-18.04
     if: contains(github.event.head_commit.message, '[skip ci]') == false
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v2.3.0
       - run: make build
       - run: make cirun cmd="npm ci"
       - run: make ciall
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 94ce19686..300fc6d0c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -9,7 +9,7 @@ jobs:
   release:
     runs-on: ubuntu-18.04
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v2.3.0
 
       - name: Dump GitHub context
         env:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 6fac65eed..06b940807 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -28,7 +28,7 @@ jobs:
           - 'macos-latest'
           - 'windows-latest'
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v2.3.0
 
       - name: Dump GitHub context
         env:
diff --git a/.github/workflows/update-major-tag.yml b/.github/workflows/update-major-tag.yml
index c06cab84d..69ee6ead9 100644
--- a/.github/workflows/update-major-tag.yml
+++ b/.github/workflows/update-major-tag.yml
@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-18.04
     steps:
 
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v2.3.0
 
     - name: Update major tag
       if: github.event.release.prerelease == false