diff --git a/.github/workflows/build-images.yml b/.github/workflows/build-images.yml
index 42d2f966aac5..dbafbfa6b612 100644
--- a/.github/workflows/build-images.yml
+++ b/.github/workflows/build-images.yml
@@ -94,7 +94,7 @@ jobs:
       - run: |
           echo "not empty" > changes
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v3.1.0
         if: ${{ github.repository_owner == 'Armbian' && github.event.inputs.choice != 'stable'  && github.event.inputs.choice != 'rc' }}
         with:
           fetch-depth: 1
@@ -146,7 +146,7 @@ jobs:
           echo "Branch: ${{ github.event.inputs.branch }}"
           echo "Version: ${{ needs.fake.outputs.version }}"
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v3.1.0
         if: ${{ github.repository_owner == 'Armbian' && github.event.inputs.choice != 'stable'  && github.event.inputs.choice != 'rc' }}
         with:
           fetch-depth: 1
@@ -347,7 +347,7 @@ jobs:
     steps:
 
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v3.1.0
         with:
           fetch-depth: 1
           ref: nightly
diff --git a/.github/workflows/lint-scripts-pr.yml b/.github/workflows/lint-scripts-pr.yml
index 19dd73407594..408ea8ce77ae 100644
--- a/.github/workflows/lint-scripts-pr.yml
+++ b/.github/workflows/lint-scripts-pr.yml
@@ -21,7 +21,7 @@ jobs:
     steps:
 
        - name: Checkout repository
-         uses: actions/checkout@v3
+         uses: actions/checkout@v3.1.0
 
        - name: Environment variables
          run: sudo -E bash -c set
diff --git a/.github/workflows/onecloud-2.yml b/.github/workflows/onecloud-2.yml
index f5479d8c2bf3..3a0ebc288676 100644
--- a/.github/workflows/onecloud-2.yml
+++ b/.github/workflows/onecloud-2.yml
@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3.1.0
         with:
           ref: onecloud_s805
 
@@ -51,7 +51,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3.1.0
 
       - name: Download artifacts
         uses: actions/download-artifact@v3
diff --git a/.github/workflows/onecloud-official.yml b/.github/workflows/onecloud-official.yml
index 2a5ea1d9dd63..751b8521b1ad 100644
--- a/.github/workflows/onecloud-official.yml
+++ b/.github/workflows/onecloud-official.yml
@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3.1.0
         with:
           ref: master
 
@@ -51,7 +51,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3.1.0
 
       - name: Download artifacts
         uses: actions/download-artifact@v3
diff --git a/.github/workflows/rebase.yml b/.github/workflows/rebase.yml
index 03313ad6753d..738ee4c32772 100644
--- a/.github/workflows/rebase.yml
+++ b/.github/workflows/rebase.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the latest code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v3.1.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           fetch-depth: 0 # otherwise, you will fail to push refs to dest repo
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index cc3a66a7b77b..7e04a3be7626 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -26,7 +26,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # v3.0.0
+        uses: actions/checkout@v3.1.0 # v3.0.0
         with:
           persist-credentials: false