diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index efecaada..e86e255a 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -32,7 +32,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.1
         with:
           # We must fetch at least the immediate parents so that if this is
           # a pull request then we can checkout the head.
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 514fb170..dd00a29f 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.1
         with:
           fetch-depth: 0 # Needed for setuptools_scm to work correctly
 
diff --git a/.github/workflows/gemini-review.yml b/.github/workflows/gemini-review.yml
index d91b5c63..d914bb08 100644
--- a/.github/workflows/gemini-review.yml
+++ b/.github/workflows/gemini-review.yml
@@ -41,7 +41,7 @@ jobs:
           permission-pull-requests: "write"
 
       - name: "Checkout repository"
-        uses: "actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd" # ratchet:actions/checkout@v5
+        uses: "actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8" # ratchet:actions/checkout@v5
 
       - name: "Run Gemini pull request review"
         uses: "google-github-actions/run-gemini-cli@v0" # ratchet:exclude
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index d45249b2..72466063 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.1
         with:
           fetch-depth: 0 # Needed for setuptools_scm to work correctly
 
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 3b408a7d..64c104fe 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -21,7 +21,7 @@ jobs:
         shell: bash
     steps:
       - name: Check out
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.1
         with:
           fetch-depth: 0 # Needed for setuptools_scm to work correctly
       - name: Install uv
diff --git a/.github/workflows/typecheck.yml b/.github/workflows/typecheck.yml
index 88ffdac3..42af218b 100644
--- a/.github/workflows/typecheck.yml
+++ b/.github/workflows/typecheck.yml
@@ -22,7 +22,7 @@ jobs:
         shell: bash
     steps:
       - name: Check out
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.1
         with:
           fetch-depth: 0 # Needed for setuptools_scm to work correctly