diff --git a/.github/workflows/k8s-diff.yaml b/.github/workflows/k8s-diff.yaml
index fdb088dad..f65f7b6e5 100644
--- a/.github/workflows/k8s-diff.yaml
+++ b/.github/workflows/k8s-diff.yaml
@@ -5,7 +5,7 @@ jobs:
     name: Base
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
         with:
           ref: ${{ github.event.pull_request.base.sha }}
       - uses: cue-lang/setup-cue@v1.0.0
@@ -18,7 +18,7 @@ jobs:
     name: Head
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
       - uses: cue-lang/setup-cue@v1.0.0
       - run: cue export ./k8s/magiclove/list.cue > list.json
       - uses: actions/upload-artifact@v3
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 90972c47c..6c0b2d7cc 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -5,6 +5,6 @@ jobs:
     name: Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
       - uses: cue-lang/setup-cue@v1.0.0
       - run: cue export ./k8s/magiclove/list.cue