diff --git a/.github/workflows/determinism-check.yml b/.github/workflows/determinism-check.yml
index 4bc2983..be9f691 100644
--- a/.github/workflows/determinism-check.yml
+++ b/.github/workflows/determinism-check.yml
@@ -13,7 +13,7 @@ jobs:
   determinism:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
         with:
           fetch-depth: 0
 
@@ -38,44 +38,45 @@ jobs:
 
           build_once() {
             out="$1"
-rm -rf "$out/dist"
-mkdir -p "$out/dist"
-cp public/index.html "$out/dist/index.html"
-cp public/404.html "$out/dist/404.html"
-cp CNAME "$out/dist/CNAME"
-cp -R surface-system "$out/dist/surface-system"
-test -f "$out/dist/index.html"
-test -f "$out/dist/404.html"
-test -f "$out/dist/CNAME"
-test -f "$out/dist/surface-system/shell/base.css"
-grep -Fx "proof.verifrax.net" "$out/dist/CNAME"
-
+            rm -rf "$out/dist"
+            mkdir -p "$out/dist"
+            cp public/index.html "$out/dist/index.html"
+            cp public/404.html "$out/dist/404.html"
+            cp CNAME "$out/dist/CNAME"
+            cp -R surface-system "$out/dist/surface-system"
+            test -f "$out/dist/index.html"
+            test -f "$out/dist/404.html"
+            test -f "$out/dist/CNAME"
+            test -f "$out/dist/surface-system/shell/base.css"
+            grep -Fx "proof.verifrax.net" "$out/dist/CNAME"
           }
 
           tree_hash() {
-            python3 - "$1" <<PY2
-import hashlib
-import sys
-from pathlib import Path
-
-root = Path(sys.argv[1])
-h = hashlib.sha256()
-
-for p in sorted(root.rglob("*")):
-    if p.is_file():
-        rel = p.relative_to(root).as_posix().encode()
-        h.update(rel)
-        h.update(b"\0")
-        h.update(p.read_bytes())
-        h.update(b"\0")
-
-print(h.hexdigest())
-PY2
+            python3 - "$1" <<'PY2'
+          import hashlib
+          import sys
+          from pathlib import Path
+
+          root = Path(sys.argv[1])
+          h = hashlib.sha256()
+
+          for p in sorted(root.rglob("*")):
+              if p.is_file():
+                  rel = p.relative_to(root).as_posix().encode()
+                  h.update(rel)
+                  h.update(b"\0")
+                  h.update(p.read_bytes())
+                  h.update(b"\0")
+
+          print(h.hexdigest())
+          PY2
           }
 
           A="$(mktemp -d)"
           B="$(mktemp -d)"
 
+          trap 'rm -rf "$A" "$B"' EXIT
+
           build_once "$A"
           build_once "$B"