diff --git a/.github/workflows/build-checks.yml b/.github/workflows/build-checks.yml
index 1f294572924..ac80912878c 100644
--- a/.github/workflows/build-checks.yml
+++ b/.github/workflows/build-checks.yml
@@ -25,7 +25,7 @@ jobs:
     name: ${{ matrix.name }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.1
       - name: Install build dependencies
         run: tools/debian_buildenv.sh setup
       - name: Create build directory
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 0cb83d93a25..a5d1ca3d5e8 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -131,7 +131,7 @@ jobs:
       artifact-windows-win64: ${{ steps.prepare_deploy.outputs.artifact-windows-win64 }}
     steps:
       - name: "Check out repository"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.1
         with:
           # This is necessary for making `git describe` work.
           fetch-depth: 0
@@ -484,7 +484,7 @@ jobs:
     if: always()
     steps:
       - name: "Check out repository"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/git.yaml b/.github/workflows/git.yaml
index aff9a077c34..f8c093b3f75 100644
--- a/.github/workflows/git.yaml
+++ b/.github/workflows/git.yaml
@@ -7,6 +7,6 @@ jobs:
     runs-on: ubuntu-22.04
 
     steps:
-      - uses: actions/checkout@v2.0.0
+      - uses: actions/checkout@v4.1.1
       - name: Block Fixup Commit Merge
         uses: 13rac1/block-fixup-merge-action@v2.0.0
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index ca42c38be43..194b886ab74 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -18,7 +18,7 @@ jobs:
     container: holzhaus/mixxx-ci:20220930
     steps:
       - name: "Check out repository"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.1
         with:
           # Unfortunately we need the whole history and can't use a shallow clone
           # because the Appstream Metadata hook parses the history to find the