diff --git a/.github/workflows/_build-container.yml b/.github/workflows/_build-container.yml
index 7cd4607b..b4893bb5 100644
--- a/.github/workflows/_build-container.yml
+++ b/.github/workflows/_build-container.yml
@@ -24,7 +24,7 @@ jobs:
   build:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/_upload-scripts.yml b/.github/workflows/_upload-scripts.yml
index 39724568..0207ba61 100644
--- a/.github/workflows/_upload-scripts.yml
+++ b/.github/workflows/_upload-scripts.yml
@@ -23,7 +23,7 @@ jobs:
   upload:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/badgesort.yml b/.github/workflows/badgesort.yml
index 829027bd..785d8782 100644
--- a/.github/workflows/badgesort.yml
+++ b/.github/workflows/badgesort.yml
@@ -23,7 +23,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/e2e-install.yml b/.github/workflows/e2e-install.yml
index f30c0e51..ac7de3ac 100644
--- a/.github/workflows/e2e-install.yml
+++ b/.github/workflows/e2e-install.yml
@@ -50,7 +50,7 @@ jobs:
       # kics-scan ignore-line — ephemeral CI-only Vaultwarden test password (not a repo secret).
       BW_PASSWORD: "CiTestPassword123!"
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
 
@@ -118,7 +118,7 @@ jobs:
     if: github.event.action != 'closed'
     runs-on: windows-2025
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
 
@@ -172,7 +172,7 @@ jobs:
     if: github.event.action != 'closed'
     runs-on: macos-26
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/megalinter.yml b/.github/workflows/megalinter.yml
index 8f268c2d..0d6d3ceb 100644
--- a/.github/workflows/megalinter.yml
+++ b/.github/workflows/megalinter.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-24.04
     if: github.event.action != 'closed' && (github.event_name == 'pull_request' || !contains(github.actor, '[bot]'))
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 55dc3d82..b82bd378 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -19,7 +19,7 @@ jobs:
         os: [ubuntu-24.04, windows-2025]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/wiki-sync.yml b/.github/workflows/wiki-sync.yml
index 100fbc70..4f47776c 100644
--- a/.github/workflows/wiki-sync.yml
+++ b/.github/workflows/wiki-sync.yml
@@ -20,7 +20,7 @@ jobs:
   sync-wiki:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false