diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1d8e3a2..023a9c5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -35,7 +35,7 @@ jobs:
     env:
       PROMTACT_TEST_POSTGRES_DSN: postgres://promtact:promtact@localhost:5432/promtact?sslmode=disable
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version: "1.25.12"
@@ -87,7 +87,7 @@ jobs:
         goos: [linux, windows]
         goarch: [amd64, arm64]
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version: "1.25.12"
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 886437d..15611e7 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -20,7 +20,7 @@ jobs:
     name: Analyze Go
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           languages: go
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 8090f5d..3a96fc8 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -14,5 +14,5 @@ jobs:
   review:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294
diff --git a/.github/workflows/deploy-self-hosted.yml b/.github/workflows/deploy-self-hosted.yml
index aafd74e..6210d9a 100644
--- a/.github/workflows/deploy-self-hosted.yml
+++ b/.github/workflows/deploy-self-hosted.yml
@@ -45,7 +45,7 @@ jobs:
             main | v[0-9]*.[0-9]*.[0-9]*) echo "deploying ref: $ref" ;;
             *) echo "::error::ref '$ref' is not allowlisted for deploy (main or vX.Y.Z only)"; exit 1 ;;
           esac
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           ref: ${{ inputs.ref }}
 
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index 8957186..81ef305 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -47,7 +47,7 @@ jobs:
     env:
       PROMTACT_TEST_POSTGRES_DSN: postgres://promtact:promtact@localhost:5432/promtact?sslmode=disable
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version: "1.25.12"
@@ -62,7 +62,7 @@ jobs:
       contents: read
       security-events: write
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b7597bb..29da5fd 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -25,7 +25,7 @@ jobs:
         goos: [linux, windows]
         goarch: [amd64, arm64]
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version: "1.25.12"