diff --git a/.github/workflows/basic.yml b/.github/workflows/basic.yml
index 57ba2c8d..d159f410 100644
--- a/.github/workflows/basic.yml
+++ b/.github/workflows/basic.yml
@@ -39,7 +39,7 @@ jobs:
 
     steps:
       - name: "Clone"
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           fetch-depth: 100
       - name: "Setup"
@@ -80,7 +80,7 @@ jobs:
 
     steps:
       - name: "Clone"
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       - name: "Setup"
         uses: ./.github/actions/node
         with:
@@ -119,7 +119,7 @@ jobs:
 
     steps:
       - name: "Clone"
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       - name: "Setup"
         uses: ./.github/actions/node
         with:
diff --git a/.github/workflows/integration-docker.yml b/.github/workflows/integration-docker.yml
index 81c93a4a..d932e933 100644
--- a/.github/workflows/integration-docker.yml
+++ b/.github/workflows/integration-docker.yml
@@ -33,7 +33,7 @@ jobs:
           - flaky: true
     steps:
       - name: "Clone"
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       - name: "Setup"
         uses: ./.github/actions/node
         with:
diff --git a/.github/workflows/integration-kube.yml b/.github/workflows/integration-kube.yml
index f0725f1a..23521fd3 100644
--- a/.github/workflows/integration-kube.yml
+++ b/.github/workflows/integration-kube.yml
@@ -17,7 +17,7 @@ jobs:
     env:
       ROOTFUL: true
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       - name: "Run Kubernetes integration tests"
         # See https://github.com/containerd/nerdctl/blob/main/docs/testing/README.md#about-parallelization
         run: |
diff --git a/.github/workflows/integration-windows.yml b/.github/workflows/integration-windows.yml
index d2c14610..1e826ff0 100644
--- a/.github/workflows/integration-windows.yml
+++ b/.github/workflows/integration-windows.yml
@@ -40,7 +40,7 @@ jobs:
         shell: bash
     steps:
       - name: "Clone"
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       - name: "Setup"
         uses: ./.github/actions/node
         with:
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index e3fe6fd0..28e7dd05 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -27,7 +27,7 @@ jobs:
           - runner: ${{ needs.env.outputs.RUNNER_LINUX_ARM64_STABLE }}
     steps:
       - name: "Clone"
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       - name: "Buildkit"
         uses: ./.github/actions/install-buildkit
       - name: "Build base dependencies for all targets"
@@ -53,7 +53,7 @@ jobs:
 ##          - runner: ${{ needs.env.outputs.RUNNER_LINUX_ARM64_STABLE }}
 #    steps:
 #      - name: "Clone"
-#        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
+#        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 #      - name: "Buildkit"
 #        uses: ./.github/actions/install-buildkit
 #      - name: "Build base dependencies for all targets"
@@ -124,7 +124,7 @@ jobs:
             flaky: true
     steps:
       - name: "Clone"
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       # FIXME: remove - only necessary if we build lepton
       - name: "Setup"
         uses: ./.github/actions/node