diff --git a/.github/workflows/workflow-generate-website.yml b/.github/workflows/workflow-generate-website.yml
index 4b740b21..30fefc16 100644
--- a/.github/workflows/workflow-generate-website.yml
+++ b/.github/workflows/workflow-generate-website.yml
@@ -49,7 +49,7 @@ jobs:
     # use this for builds triggered from the UI on protected branches
     - name: Checkout Latest (using COMMIT_TOKEN)
       if: github.event_name == 'workflow_dispatch' && github.event.inputs.commit_resources == 'true'
-      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
       with:
         token: ${{ secrets.COMMIT_TOKEN }}
         submodules: recursive
@@ -57,7 +57,7 @@ jobs:
     # use this for builds triggered from other workflows on protected branches
     - name: Checkout Latest (using access_token)
       if: github.event_name == 'push' && inputs.commit_resources == true
-      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
       with:
         token: ${{ secrets.access_token }}
         submodules: recursive
@@ -65,7 +65,7 @@ jobs:
     # use this for overything else (i.e., pull requests) where publication is not needed
     - name: Checkout Latest
       if: steps.checkout_latest_workflow.conclusion == 'skipped' && steps.checkout_latest_push.conclusion == 'skipped'
-      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
       with:
         submodules: recursive
     - name: Setup Swap Space
diff --git a/.github/workflows/workflow-validate-repo-markdown.yml b/.github/workflows/workflow-validate-repo-markdown.yml
index 173aa5ea..cacde1b8 100644
--- a/.github/workflows/workflow-validate-repo-markdown.yml
+++ b/.github/workflows/workflow-validate-repo-markdown.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
     # use this for pulls where checkout is anonymous
-    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
+    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
       with:
         submodules: recursive
     # Setup runtime environment
diff --git a/.github/workflows/workflow-validate-website-content.yml b/.github/workflows/workflow-validate-website-content.yml
index 21017f2c..f7e59799 100644
--- a/.github/workflows/workflow-validate-website-content.yml
+++ b/.github/workflows/workflow-validate-website-content.yml
@@ -23,11 +23,11 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
     - name: Checkout Latest
-      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
       with:
         fetch-depth: 0 # this ensures that the tag and commit history are available
     - name: Checkout git ref of published website content
-      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
+      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
       with:
         ref: ${{ inputs.site_git_ref }}
         path: ${{ inputs.site_git_ref_path }}