diff --git a/.github/workflows/build-scheduled.yml b/.github/workflows/build-scheduled.yml
index 7eeaae7..cf03bc6 100644
--- a/.github/workflows/build-scheduled.yml
+++ b/.github/workflows/build-scheduled.yml
@@ -29,7 +29,7 @@ jobs:
           jdk-src: ${{ vars.JDK_SRC }}
           gradle-java-version: ${{ vars.GRADLE_JAVA_VERSION }}
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         name: Checkout IDL Source Generator
         id: srcgen
         with:
diff --git a/.github/workflows/report-evidence.yml b/.github/workflows/report-evidence.yml
index cffec1c..d348def 100644
--- a/.github/workflows/report-evidence.yml
+++ b/.github/workflows/report-evidence.yml
@@ -33,7 +33,7 @@ jobs:
     steps:
       # Full history: the audit reads the pushed range, and a shallow clone would leave
       # `before` unfetched — which reads as "nothing to check" rather than as an error.
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
 
@@ -81,7 +81,7 @@ jobs:
       - name: Checkout the canonical audit
         id: canonical
         if: ${{ !cancelled() }}
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           repository: sava-software/idl-src-gen
           token: ${{ secrets.READ_SAVA_SRC_GEN }}