diff --git a/workflow-templates/moq-draft-drift.yml b/workflow-templates/moq-draft-drift.yml
index 2381f6a..8c8c32c 100644
--- a/workflow-templates/moq-draft-drift.yml
+++ b/workflow-templates/moq-draft-drift.yml
@@ -23,7 +23,7 @@ jobs:
     name: Check MoQ Transport draft version drift
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
       - name: Fetch shared drift-check script if not present
         run: |
diff --git a/workflow-templates/per-commit-gate.yml b/workflow-templates/per-commit-gate.yml
index 3198136..d347b03 100644
--- a/workflow-templates/per-commit-gate.yml
+++ b/workflow-templates/per-commit-gate.yml
@@ -35,6 +35,6 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: Run checks
         run: echo "replace with your build / test / lint"
diff --git a/workflow-templates/release-publish.yml b/workflow-templates/release-publish.yml
index 2b78a32..308e8ca 100644
--- a/workflow-templates/release-publish.yml
+++ b/workflow-templates/release-publish.yml
@@ -25,6 +25,6 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: Publish
         run: echo "replace with your release / publish step"
diff --git a/workflow-templates/reusable-workflow.yml b/workflow-templates/reusable-workflow.yml
index d40a64d..629312e 100644
--- a/workflow-templates/reusable-workflow.yml
+++ b/workflow-templates/reusable-workflow.yml
@@ -24,6 +24,6 @@ jobs:
   run:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: Reusable step
         run: echo "reusable logic here (no concurrency block belongs in this file)"
diff --git a/workflow-templates/scheduled-job.yml b/workflow-templates/scheduled-job.yml
index 02eca73..e1686f9 100644
--- a/workflow-templates/scheduled-job.yml
+++ b/workflow-templates/scheduled-job.yml
@@ -25,6 +25,6 @@ jobs:
   run:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: Scheduled task
         run: echo "replace with your scheduled task"