diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c52874a..313a879 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -31,7 +31,7 @@ jobs:
             xorg-x11-server-Xvfb
 
       # actions/checkout v5.0.0
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: Install Rust toolchain
         # dtolnay/rust-toolchain@stable was a mutable branch; the SHA pins
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9d29a89..c2b8cd1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -18,7 +18,7 @@ jobs:
     steps:
       # actions/checkout v5.0.0. Needed because `--notes-from-tag` reads
       # the annotated tag object from the local git, not the API.
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0