diff --git a/.github/workflows/ingest.yml b/.github/workflows/ingest.yml
index b45ff005..b343745f 100644
--- a/.github/workflows/ingest.yml
+++ b/.github/workflows/ingest.yml
@@ -17,7 +17,7 @@ jobs:
   ingestWebhook:
     runs-on: "ubuntu-latest"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.3
         with:
           fetch-depth: 0
       - name: Find and checkout latest updated branch
diff --git a/.github/workflows/llm-evals.yml b/.github/workflows/llm-evals.yml
index eda9dd90..8806848c 100644
--- a/.github/workflows/llm-evals.yml
+++ b/.github/workflows/llm-evals.yml
@@ -21,13 +21,13 @@ jobs:
         if: ${{ env.CAN_RUN_EVALS != 'true' }}
         run: echo "Skipping LLM evals for fork pull request because repository secrets are unavailable."
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.3
         if: ${{ env.CAN_RUN_EVALS == 'true' && github.event_name == 'pull_request' }}
         with:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.sha }}
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.3
         if: ${{ env.CAN_RUN_EVALS == 'true' && github.event_name == 'workflow_dispatch' }}
         with:
           fetch-depth: 0
diff --git a/.github/workflows/package-publish.yml b/.github/workflows/package-publish.yml
index 3563c52f..b0325793 100644
--- a/.github/workflows/package-publish.yml
+++ b/.github/workflows/package-publish.yml
@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.3
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/pages-deploy.yml b/.github/workflows/pages-deploy.yml
index a234f4f6..9bcc980f 100644
--- a/.github/workflows/pages-deploy.yml
+++ b/.github/workflows/pages-deploy.yml
@@ -30,7 +30,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.3
 
       - uses: actions/setup-node@v6
         with:
diff --git a/.github/workflows/pages-preview.yml b/.github/workflows/pages-preview.yml
index 88ab3d38..86c305bd 100644
--- a/.github/workflows/pages-preview.yml
+++ b/.github/workflows/pages-preview.yml
@@ -36,7 +36,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.3
 
       - uses: actions/setup-node@v6
         with:
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index e0766573..dbefe878 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -38,7 +38,7 @@ jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.3
       - uses: actions/setup-node@v6
         with:
           node-version: 24