diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml
index 547bc227a..9f98042b0 100644
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -7,7 +7,7 @@ jobs:
     name: checks
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # renovate: tag=v2
+    - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # renovate: tag=v2
     - uses: actions/setup-java@f0bb91606209742fe3ea40199be2f3ef195ecabf # renovate: tag=v2
       with:
         distribution: 'temurin'
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index ff5eec0bb..69b02e503 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -18,7 +18,7 @@ jobs:
       versionType: ${{ steps.version.outputs.versionType }}
       fullVersion: ${{ steps.version.outputs.fullVersion }}
     steps:
-    - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3
+    - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # tag=v3
     - name: setup java
       uses: actions/setup-java@de1bb2b0c5634f0fc4438d7aa9944e68f9bf86cc # tag=v3
       with:
@@ -42,7 +42,7 @@ jobs:
     if: needs.prepare.outputs.versionType == 'SNAPSHOT'
     environment: snapshots
     steps:
-    - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3
+    - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # tag=v3
     - uses: actions/setup-java@de1bb2b0c5634f0fc4438d7aa9944e68f9bf86cc # tag=v3
       with:
         distribution: 'temurin'
@@ -62,7 +62,7 @@ jobs:
     if: needs.prepare.outputs.versionType == 'MILESTONE'
     environment: releases
     steps:
-    - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3
+    - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # tag=v3
     - uses: actions/setup-java@de1bb2b0c5634f0fc4438d7aa9944e68f9bf86cc # tag=v3
       with:
         distribution: 'temurin'
@@ -84,7 +84,7 @@ jobs:
     if: needs.prepare.outputs.versionType == 'RELEASE'
     environment: releases
     steps:
-    - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3
+    - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # tag=v3
     - uses: actions/setup-java@de1bb2b0c5634f0fc4438d7aa9944e68f9bf86cc # tag=v3
       with:
         distribution: 'temurin'
@@ -107,7 +107,7 @@ jobs:
     permissions:
       contents: write
     steps:
-    - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3
+    - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # tag=v3
     - name: tag
       run: |
         git config --local user.name 'reactorbot'
@@ -122,7 +122,7 @@ jobs:
     permissions:
       contents: write
     steps:
-    - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3
+    - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # tag=v3
     - name: tag
       run: |
         git config --local user.name 'reactorbot'