diff --git a/.github/workflows/build-kata-static-tarball-amd64.yaml b/.github/workflows/build-kata-static-tarball-amd64.yaml
index 1a14d145ec51..4723dd60cc4d 100644
--- a/.github/workflows/build-kata-static-tarball-amd64.yaml
+++ b/.github/workflows/build-kata-static-tarball-amd64.yaml
@@ -2,6 +2,10 @@ name: CI | Build kata-static tarball for amd64
 on:
   workflow_call:
     inputs:
+      checkout-ref:
+        required: false
+        tyoe: string
+        default: ${{ github.sha }}
       tarball-suffix:
         required: false
         type: string
@@ -25,6 +29,7 @@ jobs:
     steps:
       - uses: actions/checkout@v3
         with:
+          ref: ${{ inputs.checkout-ref }}
           fetch-depth: 0 # This is needed in order to keep the commit ids history
       - name: Build ${{ matrix.asset }}
         run: |
@@ -50,6 +55,8 @@ jobs:
     needs: build-asset
     steps:
       - uses: actions/checkout@v3
+        with:
+          ref: ${{ inputs.checkout-ref }}
       - name: get-artifacts
         uses: actions/download-artifact@v3
         with:
diff --git a/.github/workflows/build-kata-static-tarball-arm64.yaml b/.github/workflows/build-kata-static-tarball-arm64.yaml
index f7b040b4a4a9..fcbe64e659d0 100644
--- a/.github/workflows/build-kata-static-tarball-arm64.yaml
+++ b/.github/workflows/build-kata-static-tarball-arm64.yaml
@@ -2,6 +2,10 @@ name: CI | Build kata-static tarball for arm64
 on:
   workflow_call:
     inputs:
+      checkout-ref:
+        required: false
+        tyoe: string
+        default: ${{ github.sha }}
       tarball-suffix:
         required: false
         type: string
@@ -29,6 +33,7 @@ jobs:
 
       - uses: actions/checkout@v3
         with:
+          ref: ${{ inputs.checkout-ref }}
           fetch-depth: 0 # This is needed in order to keep the commit ids history
       - name: Build ${{ matrix.asset }}
         run: |
@@ -58,6 +63,8 @@ jobs:
           sudo chown -R $USER:$USER $GITHUB_WORKSPACE
 
       - uses: actions/checkout@v3
+        with:
+          ref: ${{ inputs.checkout-ref }}
       - name: get-artifacts
         uses: actions/download-artifact@v3
         with:
diff --git a/.github/workflows/build-kata-static-tarball-s390x.yaml b/.github/workflows/build-kata-static-tarball-s390x.yaml
index c00795fe30a1..e905c89fd321 100644
--- a/.github/workflows/build-kata-static-tarball-s390x.yaml
+++ b/.github/workflows/build-kata-static-tarball-s390x.yaml
@@ -2,6 +2,10 @@ name: CI | Build kata-static tarball for s390x
 on:
   workflow_call:
     inputs:
+      checkout-ref:
+        required: false
+        tyoe: string
+        default: ${{ github.sha }}
       tarball-suffix:
         required: false
         type: string
@@ -25,6 +29,7 @@ jobs:
 
       - uses: actions/checkout@v3
         with:
+          ref: ${{ inputs.checkout-ref }}
           fetch-depth: 0 # This is needed in order to keep the commit ids history
       - name: Build ${{ matrix.asset }}
         run: |
@@ -55,6 +60,8 @@ jobs:
           sudo chown -R $USER:$USER $GITHUB_WORKSPACE
 
       - uses: actions/checkout@v3
+        with:
+          ref: ${{ inputs.checkout-ref }}
       - name: get-artifacts
         uses: actions/download-artifact@v3
         with:
diff --git a/.github/workflows/ci-on-push.yaml b/.github/workflows/ci-on-push.yaml
index 940be3a60631..da870d7d2a0c 100644
--- a/.github/workflows/ci-on-push.yaml
+++ b/.github/workflows/ci-on-push.yaml
@@ -11,12 +11,14 @@ jobs:
     if: ${{ github.event.workflow_run.conclusion == 'success' }}
     uses: ./.github/workflows/build-kata-static-tarball-amd64.yaml
     with:
+      checkout-ref: ${{ github.event.workflow_run.head_sha }}
       tarball-suffix: -${{ github.event.workflow_run.head_sha }}
 
   publish-kata-deploy-payload-amd64:
     needs: build-kata-static-tarball-amd64
     uses: ./.github/workflows/publish-kata-deploy-payload-amd64.yaml
     with:
+      checkout-ref: ${{ github.event.workflow_run.head_sha }}
       tarball-suffix: -${{ github.event.workflow_run.head_sha }}
       registry: ghcr.io
       repo: ${{ github.repository_owner }}/kata-deploy-ci
@@ -28,6 +30,7 @@ jobs:
     needs: publish-kata-deploy-payload-amd64
     uses: ./.github/workflows/run-k8s-tests-on-aks.yaml
     with:
+      checkout-ref: ${{ github.event.workflow_run.head_sha }}
       registry: ghcr.io
       repo: ${{ github.repository_owner }}/kata-deploy-ci
       tag: ${{ github.event.workflow_run.head_sha }}-amd64
diff --git a/.github/workflows/publish-kata-deploy-payload-amd64.yaml b/.github/workflows/publish-kata-deploy-payload-amd64.yaml
index fea62765c84b..b312e9dc877a 100644
--- a/.github/workflows/publish-kata-deploy-payload-amd64.yaml
+++ b/.github/workflows/publish-kata-deploy-payload-amd64.yaml
@@ -2,6 +2,10 @@ name: CI | Publish kata-deploy payload for amd64
 on:
   workflow_call:
     inputs:
+      checkout-ref:
+        required: false
+        tyoe: string
+        default: ${{ github.sha }}
       tarball-suffix:
         required: false
         type: string
@@ -24,6 +28,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
+        with:
+          ref: ${{ inputs.checkout-ref }}
 
       - name: get-kata-tarball
         uses: actions/download-artifact@v3
diff --git a/.github/workflows/publish-kata-deploy-payload-arm64.yaml b/.github/workflows/publish-kata-deploy-payload-arm64.yaml
index 9b8e736dc8e5..0591bfa9446e 100644
--- a/.github/workflows/publish-kata-deploy-payload-arm64.yaml
+++ b/.github/workflows/publish-kata-deploy-payload-arm64.yaml
@@ -2,6 +2,10 @@ name: CI | Publish kata-deploy payload for arm64
 on:
   workflow_call:
     inputs:
+      checkout-ref:
+        required: false
+        tyoe: string
+        default: ${{ github.sha }}
       tarball-suffix:
         required: false
         type: string
@@ -28,6 +32,8 @@ jobs:
           sudo chown -R $USER:$USER $GITHUB_WORKSPACE
 
       - uses: actions/checkout@v3
+        with:
+          ref: ${{ inputs.checkout-ref }}
 
       - name: get-kata-tarball
         uses: actions/download-artifact@v3
diff --git a/.github/workflows/publish-kata-deploy-payload-s390x.yaml b/.github/workflows/publish-kata-deploy-payload-s390x.yaml
index 89efbd58e8dc..175c1201ad51 100644
--- a/.github/workflows/publish-kata-deploy-payload-s390x.yaml
+++ b/.github/workflows/publish-kata-deploy-payload-s390x.yaml
@@ -2,6 +2,10 @@ name: CI | Publish kata-deploy payload for s390x
 on:
   workflow_call:
     inputs:
+      checkout-ref:
+        required: false
+        tyoe: string
+        default: ${{ github.sha }}
       tarball-suffix:
         required: false
         type: string
@@ -28,6 +32,8 @@ jobs:
           sudo chown -R $USER:$USER $GITHUB_WORKSPACE
 
       - uses: actions/checkout@v3
+        with:
+          ref: ${{ inputs.checkout-ref }}
 
       - name: get-kata-tarball
         uses: actions/download-artifact@v3
diff --git a/.github/workflows/run-k8s-tests-on-aks.yaml b/.github/workflows/run-k8s-tests-on-aks.yaml
index f6714068b85c..f3cad04743b4 100644
--- a/.github/workflows/run-k8s-tests-on-aks.yaml
+++ b/.github/workflows/run-k8s-tests-on-aks.yaml
@@ -2,6 +2,10 @@ name: CI | Run kubernetes tests on AKS
 on:
   workflow_call:
     inputs:
+      checkout-ref:
+        required: false
+        tyoe: string
+        default: ${{ github.sha }}
       registry:
         required: true
         type: string
@@ -36,6 +40,8 @@ jobs:
     needs: create-aks
     steps:
       - uses: actions/checkout@v3
+        with:
+          ref: ${{ inputs.checkout-ref }}
       - name: Install `bats`
         run: |
           sudo apt-get update