diff --git a/.github/workflows/build_and_push.yml b/.github/workflows/build_and_push.yml
index 9e4dd13..e04d269 100644
--- a/.github/workflows/build_and_push.yml
+++ b/.github/workflows/build_and_push.yml
@@ -10,7 +10,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v6.0.3
 
       # Inject the release tag into proto/openapi sources so that `make
       # generate` inside the Dockerfile bakes the right version into the
diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index b48c3c8..eacd7f1 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -6,7 +6,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Check out code
-      uses: actions/checkout@v6.0.2
+      uses: actions/checkout@v6.0.3
     - name: Install tools
       run: |
         make install
@@ -42,7 +42,7 @@ jobs:
           --health-retries=24
     steps:
     - name: Check out code
-      uses: actions/checkout@v6.0.2
+      uses: actions/checkout@v6.0.3
     # The service container is up for the whole job; this step is "no
     # harness" only in the sense that TESTDB_ADDR is left unset. Mirror
     # of the with-harness guard, inverted: a known harness-backed test
@@ -103,7 +103,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Check out code
-      uses: actions/checkout@v6.0.2
+      uses: actions/checkout@v6.0.3
     - name: Install tools
       run: make install
     - name: Install buf