diff --git a/.github/workflows/pr-validation.yml b/.github/workflows/pr-validation.yml
index 93adbd4ae4a..5a6ab03d288 100644
--- a/.github/workflows/pr-validation.yml
+++ b/.github/workflows/pr-validation.yml
@@ -25,7 +25,7 @@ jobs:
       uses: shivammathur/setup-php@v2
       with:
         php-version: ${{ matrix.php-versions }}
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Validate composer file
       run: |
         composer validate
diff --git a/.github/workflows/release-please-gha.yml b/.github/workflows/release-please-gha.yml
index aa209009eb2..74f98c4b6e7 100644
--- a/.github/workflows/release-please-gha.yml
+++ b/.github/workflows/release-please-gha.yml
@@ -19,7 +19,7 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Generate GitHub App token
         id: app-token
diff --git a/.github/workflows/validate-generated-api-surface.yml b/.github/workflows/validate-generated-api-surface.yml
index 807f63bcd53..9e9797c3522 100644
--- a/.github/workflows/validate-generated-api-surface.yml
+++ b/.github/workflows/validate-generated-api-surface.yml
@@ -17,7 +17,7 @@ jobs:
   validate-public-api-surface:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: microsoftgraph/kiota-dom-export-diff-tool/export@main
         id: generatePatch
       - uses: microsoftgraph/kiota-dom-export-diff-tool/tool@main