diff --git a/.github/workflows/wingman-ci.yml b/.github/workflows/wingman-ci.yml
index 74e642c..734dec1 100644
--- a/.github/workflows/wingman-ci.yml
+++ b/.github/workflows/wingman-ci.yml
@@ -9,7 +9,7 @@ jobs:
     name: lint (shellcheck)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
       - name: Install shellcheck
         run: sudo apt-get update && sudo apt-get install -y shellcheck
@@ -24,7 +24,7 @@ jobs:
     name: syntax (bash -n + py_compile)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
       - name: bash -n install.sh
         run: bash -n scripts/install.sh
@@ -72,7 +72,7 @@ jobs:
     name: install-smoke (fresh / v1->v4 / v2->v4 / v3->v4 / --force / exemptions / convergence / reviewer.tool)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
           fetch-depth: 0