diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8f65fc6..20b8fd6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -213,6 +213,7 @@ jobs:
     needs: [tag, package, docker, manifests]
     runs-on: ubuntu-latest
     steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: publish release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}