diff --git a/.github/workflows/image.yml b/.github/workflows/image.yml
index 35d4b6a4..b52a35a1 100644
--- a/.github/workflows/image.yml
+++ b/.github/workflows/image.yml
@@ -108,6 +108,7 @@ jobs:
 
     steps:
       - name: Run Sentry self-hosted e2e CI
+        # Intentionally unpinned: we should not have to bump this manually
         uses: getsentry/self-hosted@master
         with:
           project_name: taskbroker
diff --git a/.github/workflows/release-client.yml b/.github/workflows/release-client.yml
index 567e789a..1821e448 100644
--- a/.github/workflows/release-client.yml
+++ b/.github/workflows/release-client.yml
@@ -28,7 +28,7 @@ jobs:
           app-id: ${{ vars.SENTRY_RELEASE_BOT_CLIENT_ID }}
           private-key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           token: ${{ steps.token.outputs.token }}
           fetch-depth: 0
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8f01405b..556d12da 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -31,7 +31,7 @@ jobs:
         with:
           app-id: ${{ vars.SENTRY_RELEASE_BOT_CLIENT_ID }}
           private-key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           token: ${{ steps.token.outputs.token }}
           fetch-depth: 0