diff --git a/.github/workflows/opencode-publish.yml b/.github/workflows/opencode-publish.yml
index 8cd80e6f..c8347c75 100644
--- a/.github/workflows/opencode-publish.yml
+++ b/.github/workflows/opencode-publish.yml
@@ -18,10 +18,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout dotfiles
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Checkout publish repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           repository: ${{ github.repository_owner }}/opencode-config
           path: _publish
diff --git a/.github/workflows/tui-build.yml b/.github/workflows/tui-build.yml
index 52de8d8a..1f556c98 100644
--- a/.github/workflows/tui-build.yml
+++ b/.github/workflows/tui-build.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2