diff --git a/.github/workflows/draft.yml b/.github/workflows/draft.yml
index 0a0abd7..8b3ee61 100644
--- a/.github/workflows/draft.yml
+++ b/.github/workflows/draft.yml
@@ -27,7 +27,7 @@ jobs:
         key: ${{ runner.os }}-pip-
 
     - name: Clone
-      uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+      uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
 
     - name: Build specification
       run: |
@@ -36,7 +36,7 @@ jobs:
         make -f ../Makefile draft
 
     - name: Switch branch
-      uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+      uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
       with:
         ref: gh-pages
         clean: false
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 2bdde98..817daa6 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -9,7 +9,7 @@ jobs:
     name: Sanity checks before a PR merge
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+      - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
         with:
           fetch-depth: 0 # we want all refs for the --is-ancestor check
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5eb2a9a..ea5fb01 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -27,7 +27,7 @@ jobs:
         key: ${{ runner.os }}-pip-
 
     - name: Clone main
-      uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+      uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
       with:
         fetch-depth: 0
 
@@ -62,7 +62,7 @@ jobs:
 
     - name: Switch branch
       if: steps.getver.outputs.spec_version != steps.prevver.outputs.prev_version
-      uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+      uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
       with:
         ref: gh-pages
         clean: false