diff --git a/.github/workflows/dep-summaries.yml b/.github/workflows/dep-summaries.yml
index abb721bba70b..e7cbe2805013 100644
--- a/.github/workflows/dep-summaries.yml
+++ b/.github/workflows/dep-summaries.yml
@@ -25,7 +25,7 @@ jobs:
       dep-auditors-list: ${{ steps.dep-auditors.outputs.list }}
     steps:
       - name: checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v2.3.4
         if: ${{ startsWith(github.event_name, 'pull_request') }}
         with:
           ref: ${{ github.event.pull_request.head.sha }}
@@ -36,18 +36,18 @@ jobs:
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
       - name: checkout base ref
-        uses: actions/checkout@v2
+        uses: actions/checkout@v2.3.4
         if: ${{ startsWith(github.event_name, 'pull_request') }}
         with:
           ref: ${{ steps.fetch-base-ref.outputs.ref }}
           path: libra-base
       - name: checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v2.3.4
         if: ${{ github.event_name == 'push' }}
         with:
           ref: ${{ github.event.after }}
       - name: checkout base ref
-        uses: actions/checkout@v2
+        uses: actions/checkout@v2.3.4
         if: ${{ github.event_name == 'push' }}
         with:
           ref: ${{ github.event.before }}
diff --git a/.github/workflows/developer-site-ci.yml b/.github/workflows/developer-site-ci.yml
index a5886bff6360..a22cdb77a2ea 100644
--- a/.github/workflows/developer-site-ci.yml
+++ b/.github/workflows/developer-site-ci.yml
@@ -19,7 +19,7 @@ jobs:
 
     steps:
     # Checks-out the Libra website repository under $GITHUB_WORKSPACE, so job can access it
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v2.3.4
     # Installs node and yarn
     - name: Use Node.js 12
       uses: actions/setup-node@v2.1.2
diff --git a/.github/workflows/developer-site-deploy.yml b/.github/workflows/developer-site-deploy.yml
index da63564f5610..596347311893 100644
--- a/.github/workflows/developer-site-deploy.yml
+++ b/.github/workflows/developer-site-deploy.yml
@@ -15,7 +15,7 @@ jobs:
 
     steps:
     # Checks-out the Libra website repository under $GITHUB_WORKSPACE, so job can access it
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v2.3.4
     # Installs node and yarn
     - name: Use Node.js 12
       uses: actions/setup-node@v2.1.2
diff --git a/.github/workflows/hyperjump-comment.yml b/.github/workflows/hyperjump-comment.yml
index 67ba2fdbc893..ebac1c6dfd16 100644
--- a/.github/workflows/hyperjump-comment.yml
+++ b/.github/workflows/hyperjump-comment.yml
@@ -10,7 +10,7 @@ jobs:
     name: (hyperjump) comment
     steps:
       - name: checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v2.3.4
       - name: comment
         uses: libra/actions/hyperjump-comment@a9c5709
         with:
diff --git a/.github/workflows/hyperjump-labels.yml b/.github/workflows/hyperjump-labels.yml
index d4e30d2bcefc..574907129448 100644
--- a/.github/workflows/hyperjump-labels.yml
+++ b/.github/workflows/hyperjump-labels.yml
@@ -10,7 +10,7 @@ jobs:
     name: (hyperjump) labels
     steps:
       - name: checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v2.3.4
       - name: labels
         uses: libra/actions/hyperjump-labels@a9c5709
         with:
diff --git a/.github/workflows/hyperjump-request-review.yml b/.github/workflows/hyperjump-request-review.yml
index 3fa88d2843d7..9430859aa8db 100644
--- a/.github/workflows/hyperjump-request-review.yml
+++ b/.github/workflows/hyperjump-request-review.yml
@@ -10,7 +10,7 @@ jobs:
     name: (hyperjump) request-review
     steps:
       - name: checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v2.3.4
       - name: request review
         uses: libra/actions/hyperjump-request-review@a9c5709
         with:
diff --git a/.github/workflows/jsonrpc-compat.yml b/.github/workflows/jsonrpc-compat.yml
index 35c03730a011..896728cb2ca3 100644
--- a/.github/workflows/jsonrpc-compat.yml
+++ b/.github/workflows/jsonrpc-compat.yml
@@ -11,7 +11,7 @@ jobs:
     name: Warn PR author about compatibility requirements
     steps:
       - name: checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v2.3.4
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: comment
diff --git a/.github/workflows/land-blocking.yml b/.github/workflows/land-blocking.yml
index 9cc4990b31e2..86de8579f0bf 100644
--- a/.github/workflows/land-blocking.yml
+++ b/.github/workflows/land-blocking.yml
@@ -15,7 +15,7 @@ jobs:
     # The additional time can cover the retries and wait.
     timeout-minutes: 50
     steps:
-      - uses: actions/checkout@v1
+      - uses: actions/checkout@v2.3.4
       - name: Get PR number
         id: pr-num
         uses: actions/github-script@v3
diff --git a/.github/workflows/post-land.yml b/.github/workflows/post-land.yml
index 1697059f79a9..01019fb4c899 100644
--- a/.github/workflows/post-land.yml
+++ b/.github/workflows/post-land.yml
@@ -13,7 +13,7 @@ jobs:
     # The pre-release suite run time varies 1~1.5 hr.
     timeout-minutes: 120
     steps:
-      - uses: actions/checkout@v1
+      - uses: actions/checkout@v2.3.4
       - name: set_env
         id: set_env
         run: |