diff --git a/.github/workflows/bakefile-test.yml b/.github/workflows/bakefile-test.yml
index dada3a9b..a97bfb15 100644
--- a/.github/workflows/bakefile-test.yml
+++ b/.github/workflows/bakefile-test.yml
@@ -17,6 +17,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.1
       - name: Run make test
         run: make test
diff --git a/.github/workflows/core.yml b/.github/workflows/core.yml
index 1952e50b..eeab3484 100644
--- a/.github/workflows/core.yml
+++ b/.github/workflows/core.yml
@@ -26,7 +26,7 @@ jobs:
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.1.1
       - id: set-json
         run: |
           JSON=build/matrix/latest.json
@@ -48,7 +48,7 @@ jobs:
       fail-fast: false
       matrix: ${{fromJson(needs.generate_matrix.outputs.matrix)}}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.1.1
       - name: Login to Docker Hub
         uses: docker/login-action@v3
         with:
diff --git a/.github/workflows/devel.yml b/.github/workflows/devel.yml
index 4ef51312..cee5d2af 100644
--- a/.github/workflows/devel.yml
+++ b/.github/workflows/devel.yml
@@ -16,7 +16,7 @@ jobs:
       matrix:
         bakefile: [devel.docker-bake.json, core-latest-daily.docker-bake.json]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.1.1
       - uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USER }}
diff --git a/.github/workflows/dockerfiles.yml b/.github/workflows/dockerfiles.yml
index 7e668803..ad6dd03a 100644
--- a/.github/workflows/dockerfiles.yml
+++ b/.github/workflows/dockerfiles.yml
@@ -12,7 +12,7 @@ jobs:
     container:
       image: rocker/tidyverse:latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.1.1
       - name: Set as safe for following git commands
         run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
       - name: install packages
diff --git a/.github/workflows/extra.yml b/.github/workflows/extra.yml
index 43a3c3d5..60ee52b4 100644
--- a/.github/workflows/extra.yml
+++ b/.github/workflows/extra.yml
@@ -15,7 +15,7 @@ jobs:
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.1.1
       - id: set-matrix
         run: |
           CONTENT=$(jq '{ group: [.group[] | keys[] | select(. != "default")] } | tostring' -r bakefiles/extra.docker-bake.json)
@@ -29,7 +29,7 @@ jobs:
       fail-fast: false
       matrix: ${{fromJson(needs.generate_matrix.outputs.matrix)}}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.1.1
       - name: Login to Docker Hub
         uses: docker/login-action@v3
         with:
diff --git a/.github/workflows/linting.yml b/.github/workflows/linting.yml
index a381827c..d960befc 100644
--- a/.github/workflows/linting.yml
+++ b/.github/workflows/linting.yml
@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/r-build-test.yml b/.github/workflows/r-build-test.yml
index 71aa72b9..dd70cd93 100644
--- a/.github/workflows/r-build-test.yml
+++ b/.github/workflows/r-build-test.yml
@@ -28,7 +28,7 @@ jobs:
         platforms:
           - linux/amd64
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.1.1
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
       - name: Expose GitHub Runtime
@@ -70,7 +70,7 @@ jobs:
           - install_shiny_server.sh
           - install_geospatial.sh
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.1.1
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
       - name: Expose GitHub Runtime
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 876966f1..b48e59f1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,7 +13,7 @@ jobs:
     outputs:
       tag: ${{ steps.tag-version.outputs.new_tag }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.1.1
 
       - id: set-version
         run: |
@@ -34,7 +34,7 @@ jobs:
     needs: create_tag
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.1.1
       - name: Create Release
         uses: ncipollo/release-action@v1
         with:
diff --git a/.github/workflows/reports.yml b/.github/workflows/reports.yml
index 0b556fa2..0f2dea18 100644
--- a/.github/workflows/reports.yml
+++ b/.github/workflows/reports.yml
@@ -31,7 +31,7 @@ jobs:
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.1.1
       - id: set-matrix
         run: |
           CONTENT=$(jq -r '.r_version += ["extra"] | tostring' build/matrix/all.json)
@@ -45,7 +45,7 @@ jobs:
       fail-fast: false
       matrix: ${{fromJson(needs.generate_matrix.outputs.matrix)}}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.1.1
       - name: Clean up
         run: |
           docker image prune --all --force
@@ -72,12 +72,12 @@ jobs:
       image: rocker/tidyverse:latest
     steps:
       - name: Checkout main
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.1
       - name: Set as safe for following git commands
         run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
       - name: Checkout wiki
         if: github.event_name != 'pull_request'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.1
         with:
           repository: "${{ github.repository }}.wiki"
           path: reports
diff --git a/.github/workflows/scripts-test.yml b/.github/workflows/scripts-test.yml
index 2cd6f368..6d5402f7 100644
--- a/.github/workflows/scripts-test.yml
+++ b/.github/workflows/scripts-test.yml
@@ -23,7 +23,7 @@ jobs:
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.1.1
       - id: set-matrix
         run: |
           CONTENT=$(jq 'tostring' -r tests/rocker_scripts/matrix.json)
@@ -37,7 +37,7 @@ jobs:
       fail-fast: false
       matrix: ${{fromJson(needs.generate_matrix.outputs.matrix)}}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.1.1
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
       - name: Prepare build
diff --git a/.github/workflows/test-experimental.yml b/.github/workflows/test-experimental.yml
index 287f45f6..92026018 100644
--- a/.github/workflows/test-experimental.yml
+++ b/.github/workflows/test-experimental.yml
@@ -17,7 +17,7 @@ jobs:
       image: rocker/r-ver
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.1.1
         with:
           fetch-depth: 0
       - name: build