diff --git a/.github/workflows/check-docs.yml b/.github/workflows/check-docs.yml
index a52c3196..802a67cf 100644
--- a/.github/workflows/check-docs.yml
+++ b/.github/workflows/check-docs.yml
@@ -19,7 +19,7 @@ jobs:
     if: ${{ needs.pre_job.outputs.should_skip != 'true' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           fetch-depth: 0
       - name: Install system dependencies
diff --git a/.github/workflows/check_migrations_sqlite.yml b/.github/workflows/check_migrations_sqlite.yml
index 91cbaf06..8c59fcaa 100644
--- a/.github/workflows/check_migrations_sqlite.yml
+++ b/.github/workflows/check_migrations_sqlite.yml
@@ -18,7 +18,7 @@ jobs:
     needs: pre_job
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           fetch-depth: 0
       - name: Install uv
@@ -52,7 +52,7 @@ jobs:
           echo "Acquire::Check-Valid-Until \"false\";" > /etc/apt/apt.conf.d/99archive
           apt-get -y -qq update
           apt-get install -y build-essential tcl git-lfs
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         if: ${{ needs.pre_job.outputs.should_skip != 'true' }}
         with:
           lfs: true
diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml
index d986257c..094c69c0 100644
--- a/.github/workflows/python-publish.yml
+++ b/.github/workflows/python-publish.yml
@@ -9,7 +9,7 @@ jobs:
   deploy:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           fetch-depth: 0
       - name: Install uv
diff --git a/.github/workflows/tox.yml b/.github/workflows/tox.yml
index 916207d9..248a4fd2 100644
--- a/.github/workflows/tox.yml
+++ b/.github/workflows/tox.yml
@@ -18,7 +18,7 @@ jobs:
     needs: pre_job
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           fetch-depth: 0
       - name: Install uv
@@ -46,7 +46,7 @@ jobs:
       matrix:
         python-version: [3.9, '3.10', '3.11', '3.12', '3.13', '3.14']
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
       - name: Download wheel artifact
         if: ${{ needs.pre_job.outputs.should_skip != 'true' }}
         uses: actions/download-artifact@v8
@@ -77,7 +77,7 @@ jobs:
     container:
       image: python:${{ matrix.python-version }}-buster
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
       - name: Download wheel artifact
         if: ${{ needs.pre_job.outputs.should_skip != 'true' }}
         uses: actions/download-artifact@v8
@@ -109,7 +109,7 @@ jobs:
       matrix:
         python-version: [3.9, '3.10', '3.11', '3.12', '3.13', '3.14']
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
       - name: Download wheel artifact
         if: ${{ needs.pre_job.outputs.should_skip != 'true' }}
         uses: actions/download-artifact@v8
@@ -146,7 +146,7 @@ jobs:
     container:
       image: python:${{ matrix.python-version }}-buster
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
       - name: Download wheel artifact
         if: ${{ needs.pre_job.outputs.should_skip != 'true' }}
         uses: actions/download-artifact@v8
@@ -196,7 +196,7 @@ jobs:
           # Maps tcp port 5432 on service container to the host
           - 5432:5432
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
       - name: Download wheel artifact
         if: ${{ needs.pre_job.outputs.should_skip != 'true' }}
         uses: actions/download-artifact@v8
@@ -225,7 +225,7 @@ jobs:
       matrix:
         python-version: [3.8]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
       - name: Download wheel artifact
         if: ${{ needs.pre_job.outputs.should_skip != 'true' }}
         uses: actions/download-artifact@v8