diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index e227468d..b6597215 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # runner runs as userid 1001 but userid 1000 is baked into docker image.
       # we could adjust this if needed via env var but this should work