diff --git a/.github/workflows/browsertesting-open-issue.yml b/.github/workflows/browsertesting-open-issue.yml
index 5320e984fd84..77effbc8bf19 100644
--- a/.github/workflows/browsertesting-open-issue.yml
+++ b/.github/workflows/browsertesting-open-issue.yml
@@ -14,7 +14,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.0
 
       # copilot can be assigned to the issue
       # https://cli.github.com/manual/gh_issue_create
diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
index 88bec1bde403..c5a4943fdcaa 100644
--- a/.github/workflows/copilot-setup-steps.yml
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -14,7 +14,7 @@ jobs:
     # You can define any steps you want, and they will run before the agent starts.
     # If you do not check out your code, Copilot will do this for you.
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v4.2.2
+      - uses: actions/checkout@c2d88d3ecc89a9ef08eebf45d9637801dcee7eb5 # v4.2.2
 
       # Include PrepareForHelix to maximise what is downloaded here
       - name: Build solution
diff --git a/.github/workflows/locker.yml b/.github/workflows/locker.yml
index 6dc084a99217..9110ba0608f1 100644
--- a/.github/workflows/locker.yml
+++ b/.github/workflows/locker.yml
@@ -23,7 +23,7 @@ jobs:
     if: ${{ github.repository_owner == 'dotnet' }}
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v4.2.2
+        uses: actions/checkout@c2d88d3ecc89a9ef08eebf45d9637801dcee7eb5 # v4.2.2
         with:
           repository: "microsoft/vscode-github-triage-actions"
           path: ./actions
diff --git a/.github/workflows/markdownlint.yml b/.github/workflows/markdownlint.yml
index 0d8cdccc86e3..d5f3ec52960e 100644
--- a/.github/workflows/markdownlint.yml
+++ b/.github/workflows/markdownlint.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v4.2.2
+    - uses: actions/checkout@c2d88d3ecc89a9ef08eebf45d9637801dcee7eb5 # v4.2.2
     - name: Use Node.js
       uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
       with:
diff --git a/.github/workflows/runtime-sync.yml b/.github/workflows/runtime-sync.yml
index 9a79582c55fa..60f99507e9c2 100644
--- a/.github/workflows/runtime-sync.yml
+++ b/.github/workflows/runtime-sync.yml
@@ -21,14 +21,14 @@ jobs:
     runs-on: windows-latest
     steps:
     - name: Checkout aspnetcore
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v4.2.2
+      uses: actions/checkout@c2d88d3ecc89a9ef08eebf45d9637801dcee7eb5 # v4.2.2
       with:
         # Test this script using changes in a fork
         repository: 'dotnet/aspnetcore'
         path: aspnetcore
         ref: main
     - name: Checkout runtime
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v4.2.2
+      uses: actions/checkout@c2d88d3ecc89a9ef08eebf45d9637801dcee7eb5 # v4.2.2
       with:
         # Test this script using changes in a fork
         repository: 'dotnet/runtime'
diff --git a/.github/workflows/update-jquery-validate.yml b/.github/workflows/update-jquery-validate.yml
index 92060a126c29..576802f8c84d 100644
--- a/.github/workflows/update-jquery-validate.yml
+++ b/.github/workflows/update-jquery-validate.yml
@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v4.2.2
+        uses: actions/checkout@c2d88d3ecc89a9ef08eebf45d9637801dcee7eb5 # v4.2.2
 
       - name: Setup Node.js
         uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
diff --git a/.github/workflows/update-sdk.yml b/.github/workflows/update-sdk.yml
index ec9edd60b318..9083bc5a6b33 100644
--- a/.github/workflows/update-sdk.yml
+++ b/.github/workflows/update-sdk.yml
@@ -19,7 +19,7 @@ jobs:
     name: Update .NET SDK
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v4.2.2
+    - uses: actions/checkout@c2d88d3ecc89a9ef08eebf45d9637801dcee7eb5 # v4.2.2
     - uses: martincostello/update-dotnet-sdk@76e2c0df2303d4f6a404228105ebb7d60ace0556 # v3.4.0
       with:
         quality: 'daily'
diff --git a/.github/workflows/update-selenium-and-playwright-dependencies.yml b/.github/workflows/update-selenium-and-playwright-dependencies.yml
index 723e1f0b7d12..e4c5801e86c9 100644
--- a/.github/workflows/update-selenium-and-playwright-dependencies.yml
+++ b/.github/workflows/update-selenium-and-playwright-dependencies.yml
@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v4.2.2
+        uses: actions/checkout@c2d88d3ecc89a9ef08eebf45d9637801dcee7eb5 # v4.2.2
 
       - name: Update dependencies
         run: pwsh eng/scripts/update-selenium-and-playwright-versions.ps1
diff --git a/.github/workflows/validate-npm-package-lock-json.yml b/.github/workflows/validate-npm-package-lock-json.yml
index 013f075055c5..07ed28362235 100644
--- a/.github/workflows/validate-npm-package-lock-json.yml
+++ b/.github/workflows/validate-npm-package-lock-json.yml
@@ -14,7 +14,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v4.2.2
+        uses: actions/checkout@c2d88d3ecc89a9ef08eebf45d9637801dcee7eb5 # v4.2.2
         with:
           fetch-depth: 0
           submodules: false