diff --git a/.github/workflows/claude-audit-labeler.yml b/.github/workflows/claude-audit-labeler.yml
index 40f6b7b..242d99b 100644
--- a/.github/workflows/claude-audit-labeler.yml
+++ b/.github/workflows/claude-audit-labeler.yml
@@ -48,7 +48,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Check out Code Mower support files from default branch
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           ref: ${{ github.event.repository.default_branch }}
           persist-credentials: false
diff --git a/.github/workflows/claude-clear-stale.yml b/.github/workflows/claude-clear-stale.yml
index 7abd47f..6360eb8 100644
--- a/.github/workflows/claude-clear-stale.yml
+++ b/.github/workflows/claude-clear-stale.yml
@@ -44,7 +44,7 @@ jobs:
       # CLEAR_STALE_DISPATCH_INPUTS: |
       #   pr_number={pr}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/code-mower-gate.yml b/.github/workflows/code-mower-gate.yml
index 59b5695..cbf3a49 100644
--- a/.github/workflows/code-mower-gate.yml
+++ b/.github/workflows/code-mower-gate.yml
@@ -42,7 +42,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Check out Code Mower support files from default branch
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           ref: ${{ github.event.repository.default_branch }}
           persist-credentials: false
diff --git a/.github/workflows/codex-audit-labeler.yml b/.github/workflows/codex-audit-labeler.yml
index 468b9e4..3052e2a 100644
--- a/.github/workflows/codex-audit-labeler.yml
+++ b/.github/workflows/codex-audit-labeler.yml
@@ -48,7 +48,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Check out Code Mower support files from default branch
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           ref: ${{ github.event.repository.default_branch }}
           persist-credentials: false
diff --git a/.github/workflows/codex-clear-stale.yml b/.github/workflows/codex-clear-stale.yml
index 08c8427..2f94d53 100644
--- a/.github/workflows/codex-clear-stale.yml
+++ b/.github/workflows/codex-clear-stale.yml
@@ -44,7 +44,7 @@ jobs:
       # CLEAR_STALE_DISPATCH_INPUTS: |
       #   pr_number={pr}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/lane-mac-runner.yml b/.github/workflows/lane-mac-runner.yml
index 0535bef..3ca7bba 100644
--- a/.github/workflows/lane-mac-runner.yml
+++ b/.github/workflows/lane-mac-runner.yml
@@ -95,7 +95,7 @@ jobs:
 
       - name: Checkout lane tools
         if: steps.selection.outputs.skip != 'true'
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           ref: ${{ github.event.repository.default_branch }}
           persist-credentials: false
diff --git a/.github/workflows/local-cli-audit.yml b/.github/workflows/local-cli-audit.yml
index 9215e06..55e71a5 100644
--- a/.github/workflows/local-cli-audit.yml
+++ b/.github/workflows/local-cli-audit.yml
@@ -64,7 +64,7 @@ jobs:
           echo "Using Code Mower runner label code-mower-audit"
 
       - name: Check out trusted Code Mower support files from default branch
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           ref: ${{ github.event.repository.default_branch }}
           path: code-mower-support
@@ -76,7 +76,7 @@ jobs:
           rm -rf "${PR_HEAD_PATH}"
 
       - name: Check out pull request head
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           path: pr-head