diff --git a/.github/workflows/flake-check.yml b/.github/workflows/flake-check.yml
index 28d0848..2be2489 100644
--- a/.github/workflows/flake-check.yml
+++ b/.github/workflows/flake-check.yml
@@ -17,7 +17,7 @@ jobs:
     permissions:
       contents: read # strictest possible
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 (Jan 2026)
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.2 (Jan 2026)
       - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22 (Mar 2026)
       - name: format check (treefmt)
         # Fast-fail on unformatted files (nixfmt + shfmt) before the heavy build. `nix flake
diff --git a/.github/workflows/flake-update.yml b/.github/workflows/flake-update.yml
index 8f9909a..ca4452a 100644
--- a/.github/workflows/flake-update.yml
+++ b/.github/workflows/flake-update.yml
@@ -30,7 +30,7 @@ jobs:
         with:
           app-id: ${{ vars.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 (Jan 2026)
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.2 (Jan 2026)
       - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22 (Mar 2026)
       - name: nix flake update
         run: nix flake update
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 64ca322..1e1c3ad 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -31,7 +31,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
       - name: build docs site
         run: nix build .#docs -L