diff --git a/.github/workflows/ci-long-run.yml b/.github/workflows/ci-long-run.yml
index 91662760..c76b74af 100644
--- a/.github/workflows/ci-long-run.yml
+++ b/.github/workflows/ci-long-run.yml
@@ -73,7 +73,7 @@ jobs:
       SEED: ${{ inputs.seed }}
       DEMO: ${{ inputs.demo }}
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           ref: ${{ inputs.commit }}
           persist-credentials: false
@@ -140,7 +140,7 @@ jobs:
       status: ${{ steps.result.outputs.status }}
     env: *gate-env
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           ref: ${{ inputs.commit }}
           persist-credentials: false
diff --git a/.github/workflows/ci-nightly.yml b/.github/workflows/ci-nightly.yml
index 26d64569..f78d6ebf 100644
--- a/.github/workflows/ci-nightly.yml
+++ b/.github/workflows/ci-nightly.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: [self-hosted, linux, x64, podman, vfd-lantern]
     timeout-minutes: 180
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
       - name: Verify runner and prepare pinned nightly tools
diff --git a/.github/workflows/ci-quality.yml b/.github/workflows/ci-quality.yml
index bbba912f..efd3a58e 100644
--- a/.github/workflows/ci-quality.yml
+++ b/.github/workflows/ci-quality.yml
@@ -21,7 +21,7 @@ jobs:
     timeout-minutes: 120
     steps:
       - name: Check out exact source
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           ref: ${{ inputs.commit }}
           persist-credentials: false
diff --git a/.github/workflows/docs-pages.yml b/.github/workflows/docs-pages.yml
index 4d0b9417..4a324d79 100644
--- a/.github/workflows/docs-pages.yml
+++ b/.github/workflows/docs-pages.yml
@@ -31,7 +31,7 @@ jobs:
     runs-on: [self-hosted, linux, x64, podman, vfd-lantern]
     steps:
       - name: Check out exact source
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           ref: ${{ inputs.commit }}
           persist-credentials: false
diff --git a/.github/workflows/issue21-acceptance.yml b/.github/workflows/issue21-acceptance.yml
index cee60682..98fedada 100644
--- a/.github/workflows/issue21-acceptance.yml
+++ b/.github/workflows/issue21-acceptance.yml
@@ -23,7 +23,7 @@ jobs:
       profile: ${{ steps.hashes.outputs.profile }}
       scenario: ${{ steps.hashes.outputs.scenario }}
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
       - name: Build nonproduction fixture inside pinned Trixie
diff --git a/.github/workflows/issue24-final-acceptance.yml b/.github/workflows/issue24-final-acceptance.yml
index 3a4330ff..be8279d5 100644
--- a/.github/workflows/issue24-final-acceptance.yml
+++ b/.github/workflows/issue24-final-acceptance.yml
@@ -60,7 +60,7 @@ jobs:
           pkg-config --exists libudev
 
       - name: Check out exact triggering commit
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           ref: ${{ github.sha }}
           fetch-depth: 0
diff --git a/.github/workflows/issue24-native-package-acceptance.yml b/.github/workflows/issue24-native-package-acceptance.yml
index b2786196..5edecaaf 100644
--- a/.github/workflows/issue24-native-package-acceptance.yml
+++ b/.github/workflows/issue24-native-package-acceptance.yml
@@ -31,7 +31,7 @@ jobs:
     outputs:
       version: ${{ steps.version.outputs.version }}
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           ref: ${{ github.sha }}
           persist-credentials: false
@@ -80,7 +80,7 @@ jobs:
     needs: [build, finalize, publish-validation]
     runs-on: [self-hosted, linux, x64, podman, vfd-lantern]
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           ref: ${{ github.sha }}
           persist-credentials: false
diff --git a/.github/workflows/package-test.yml b/.github/workflows/package-test.yml
index 1f25cd0f..5074c945 100644
--- a/.github/workflows/package-test.yml
+++ b/.github/workflows/package-test.yml
@@ -60,7 +60,7 @@ jobs:
           fi
 
       - name: Check out exact source
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           ref: ${{ inputs.commit }}
           persist-credentials: false
diff --git a/.github/workflows/release-candidate-build.yml b/.github/workflows/release-candidate-build.yml
index 8085eb81..f653dbff 100644
--- a/.github/workflows/release-candidate-build.yml
+++ b/.github/workflows/release-candidate-build.yml
@@ -113,7 +113,7 @@ jobs:
           case "${{ inputs.version }}" in *-rc*|*RC*) echo 'candidate version must already be final' >&2; exit 1;; esac
 
       - name: Check out exact candidate
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           ref: ${{ inputs.commit }}
           fetch-depth: 0
@@ -228,7 +228,7 @@ jobs:
           test "${VERSION_ID%%.*}" = 13
 
       - name: Check out exact candidate
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           ref: ${{ inputs.commit }}
           fetch-depth: 0
diff --git a/.github/workflows/release-candidate-finalize.yml b/.github/workflows/release-candidate-finalize.yml
index f231cb2e..47ba7e0b 100644
--- a/.github/workflows/release-candidate-finalize.yml
+++ b/.github/workflows/release-candidate-finalize.yml
@@ -131,7 +131,7 @@ jobs:
           fi
 
       - name: Check out exact candidate
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           ref: ${{ inputs.commit }}
           fetch-depth: 0
diff --git a/.github/workflows/release-publish.yml b/.github/workflows/release-publish.yml
index 1804e895..5425261f 100644
--- a/.github/workflows/release-publish.yml
+++ b/.github/workflows/release-publish.yml
@@ -83,7 +83,7 @@ jobs:
           [[ "${{ inputs.finalized_artifact_run_id }}" =~ ^[1-9][0-9]*$ ]]
 
       - name: Check out exact candidate
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           ref: ${{ inputs.commit }}
           fetch-depth: 0