diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1df2119bf9..709d7ccd58 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -27,7 +27,7 @@ jobs:
       group: ${{ github.ref == 'refs/heads/develop' && format('build-develop-{0}-{1}', matrix.variant, github.sha) || format('build-{0}-{1}', matrix.variant, github.ref)  }}
       cancel-in-progress: true
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         with:
           # Ensure we are building the branch and not the branch after being merged on develop
           # https://github.com/actions/checkout/issues/881
diff --git a/.github/workflows/danger.yml b/.github/workflows/danger.yml
index 8551cb44c0..e2aa8e1266 100644
--- a/.github/workflows/danger.yml
+++ b/.github/workflows/danger.yml
@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Danger main check
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       - run: |
           npm install --save-dev @babel/plugin-transform-flow-strip-types
       - name: Danger
diff --git a/.github/workflows/gradle-wrapper-update.yml b/.github/workflows/gradle-wrapper-update.yml
index 33a12d3c54..f9e998b1a0 100644
--- a/.github/workflows/gradle-wrapper-update.yml
+++ b/.github/workflows/gradle-wrapper-update.yml
@@ -8,7 +8,7 @@ jobs:
   update-gradle-wrapper:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       - name: Update Gradle Wrapper
         uses: gradle-update/update-gradle-wrapper-action@v1
         # Skip in forks
diff --git a/.github/workflows/gradle-wrapper-validation.yml b/.github/workflows/gradle-wrapper-validation.yml
index 271c5399f6..bf1ca46700 100644
--- a/.github/workflows/gradle-wrapper-validation.yml
+++ b/.github/workflows/gradle-wrapper-validation.yml
@@ -11,5 +11,5 @@ jobs:
     runs-on: ubuntu-latest
     # No concurrency required, this is a prerequisite to other actions and should run every time.
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       - uses: gradle/wrapper-validation-action@v1
diff --git a/.github/workflows/maestro.yml b/.github/workflows/maestro.yml
index 46ee84896f..6f6edd9a31 100644
--- a/.github/workflows/maestro.yml
+++ b/.github/workflows/maestro.yml
@@ -24,7 +24,7 @@ jobs:
       group: ${{ format('maestro-{0}', github.ref) }}
       cancel-in-progress: true
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         with:
           # Ensure we are building the branch and not the branch after being merged on develop
           # https://github.com/actions/checkout/issues/881
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 85c9ed1422..e2b027aebe 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ github.repository == 'vector-im/element-x-android' }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       - name: Use JDK 17
         uses: actions/setup-java@v3
         with:
diff --git a/.github/workflows/nightlyReports.yml b/.github/workflows/nightlyReports.yml
index 65f3cbb53c..c1d73117b9 100644
--- a/.github/workflows/nightlyReports.yml
+++ b/.github/workflows/nightlyReports.yml
@@ -55,7 +55,7 @@ jobs:
     name: Dependency analysis
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       - name: Use JDK 17
         uses: actions/setup-java@v3
         with:
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index 9c0aac7aef..fad3b13cb2 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -17,7 +17,7 @@ jobs:
     name: Search for forbidden patterns
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       - name: Run code quality check suite
         run: ./tools/check/check_code_quality.sh
 
@@ -29,7 +29,7 @@ jobs:
       group: ${{ github.ref == 'refs/heads/main' && format('check-main-{0}', github.sha) || github.ref == 'refs/heads/develop' && format('check-develop-{0}', github.sha) || format('check-{0}', github.ref) }}
       cancel-in-progress: true
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         with:
           # Ensure we are building the branch and not the branch after being merged on develop
           # https://github.com/actions/checkout/issues/881
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7e535a1467..b701b7d69e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -18,7 +18,7 @@ jobs:
       group: ${{ github.ref == 'refs/head/main' && format('build-release-main-{0}', github.sha) }}
       cancel-in-progress: true
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       - name: Use JDK 17
         uses: actions/setup-java@v3
         with:
diff --git a/.github/workflows/sonar.yml b/.github/workflows/sonar.yml
index 42846c2cd5..3a37e9ead1 100644
--- a/.github/workflows/sonar.yml
+++ b/.github/workflows/sonar.yml
@@ -21,7 +21,7 @@ jobs:
       group: ${{ github.ref == 'refs/heads/main' && format('sonar-main-{0}', github.sha) || github.ref == 'refs/heads/develop' && format('sonar-develop-{0}', github.sha) || format('sonar-{0}', github.ref) }}
       cancel-in-progress: true
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         with:
           # Ensure we are building the branch and not the branch after being merged on develop
           # https://github.com/actions/checkout/issues/881
diff --git a/.github/workflows/sync-localazy.yml b/.github/workflows/sync-localazy.yml
index 3d63f8b542..e4242aa634 100644
--- a/.github/workflows/sync-localazy.yml
+++ b/.github/workflows/sync-localazy.yml
@@ -11,7 +11,7 @@ jobs:
     # Skip in forks
     if: github.repository == 'vector-im/element-x-android'
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       - name: Set up Python 3.9
         uses: actions/setup-python@v4
         with: