diff --git a/.github/workflows/rebase.yaml b/.github/workflows/rebase.yaml
index f795ade..b3866ef 100644
--- a/.github/workflows/rebase.yaml
+++ b/.github/workflows/rebase.yaml
@@ -14,7 +14,7 @@ jobs:
       )
     steps:
       - name: Checkout the latest code
-        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
         with:
           token: ${{ secrets.GH_TOKEN_AUTOMATIC_REBASE }}
           fetch-depth: 0 # otherwise, you will fail to push refs to dest repo
diff --git a/.github/workflows/renovate-config-validator.yaml b/.github/workflows/renovate-config-validator.yaml
index 084a43a..1485b08 100644
--- a/.github/workflows/renovate-config-validator.yaml
+++ b/.github/workflows/renovate-config-validator.yaml
@@ -12,6 +12,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
       - name: Validate
         uses: rinchsan/renovate-config-validator@c5d3f4c55a5bea4916b59b056871bbb2a14d0cb7 # tag=v0.0.11