diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml
index 629e7ae..6eebf4d 100644
--- a/.gitea/workflows/cd.yaml
+++ b/.gitea/workflows/cd.yaml
@@ -10,7 +10,7 @@ jobs:
     name: Release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
         with:
           fetch-depth: 0
       - name: Increment tag
diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 63ac466..017c115 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -16,7 +16,7 @@ jobs:
           - "common.json"
           - "docker-compose.json"
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
       - name: Validate "${{ matrix.json-file }}"
         uses: https://gitea.t000-n.de/t.behrendt/validate-json-by-json-schema-action@0.1.2
         with:
diff --git a/.gitea/workflows/prerelease.yaml b/.gitea/workflows/prerelease.yaml
index 0226d22..127c70d 100644
--- a/.gitea/workflows/prerelease.yaml
+++ b/.gitea/workflows/prerelease.yaml
@@ -8,7 +8,7 @@ jobs:
     name: Prerelease
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
         with:
           fetch-depth: 0
       - name: Increment tag