diff --git a/.github/workflows/repotests.yml b/.github/workflows/repotests.yml
index dec4cbec72..ca0d77faff 100644
--- a/.github/workflows/repotests.yml
+++ b/.github/workflows/repotests.yml
@@ -95,22 +95,27 @@ jobs:
       - uses: actions/checkout@v4
         with:
           repository: 'flutter/gallery'
+          ref: 'v2.10.2'
           path: 'repotests/gallery'
       - uses: actions/checkout@v4
         with:
           repository: 'gojek/ziggurat'
+          ref: '4.9.4'
           path: 'repotests/ziggurat'
       - uses: actions/checkout@v4
         with:
           repository: 'apple/swift-markdown'
+          ref: '0.3.0'
           path: 'repotests/swift-markdown'
       - uses: actions/checkout@v4
         with:
           repository: 'GoogleCloudPlatform/microservices-demo'
+          ref: 'v0.8.1'
           path: 'repotests/microservices-demo'
       - uses: actions/checkout@v4
         with:
           repository: 'zoom/meetingsdk-vuejs-sample'
+          ref: 'v2.18.0'
           path: 'repotests/meetingsdk-vuejs-sample'
       - uses: actions/checkout@v4
         with:
@@ -119,34 +124,42 @@ jobs:
       - uses: actions/checkout@v4
         with:
           repository: 'openpbs/openpbs'
+          ref: 'v23.06.06'
           path: 'repotests/openpbs'
       - uses: actions/checkout@v4
         with:
           repository: 'home-assistant/android'
+          ref: '2023.11.3'
           path: 'repotests/ha-android'
       - uses: actions/checkout@v4
         with:
           repository: 'rust-lang/rust'
+          ref: '1.74.0'
           path: 'repotests/rs-rust'
       - uses: actions/checkout@v4
         with:
           repository: 'rust-lang/cargo'
+          ref: '0.75.0'
           path: 'repotests/rs-cargo'
       - uses: actions/checkout@v4
         with:
           repository: 'Keats/validator'
+          ref: 'v0.15.0'
           path: 'repotests/rs-validator'
       - uses: actions/checkout@v4
         with:
           repository: 'tokio-rs/axum'
+          ref: 'axum-v0.6.20'
           path: 'repotests/rs-axum'
       - uses: actions/checkout@v4
         with:
           repository: 'fsprojects/FAKE'
+          ref: '6.0.0'
           path: 'repotests/dotnet-paket'
       - uses: actions/checkout@v4
         with:
           repository: 'appthreat/blint'
+          ref: 'v1.0.34'
           path: 'repotests/blint'
       - uses: actions/checkout@v4
         with:
@@ -155,6 +168,7 @@ jobs:
       - uses: actions/checkout@v3
         with:
           repository: 'DefectDojo/django-DefectDojo'
+          ref: '2.28.2'
           path: 'repotests/django-DefectDojo'
       - uses: actions/checkout@v3
         with: