diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 5d457f7d8e7..abc09274afa 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -29,7 +29,7 @@ jobs:
     env:
       DOCKER_CLI_EXPERIMENTAL: "enabled"
     steps:
-      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v3
+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v3
         with:
           fetch-depth: 0
       - uses: arduino/setup-task@b91d5d2c96a56797b48ac1e0e89220bf64044611 # v1
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index f17561df7fa..03235235b56 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -15,7 +15,7 @@ jobs:
       contents: read
 
     steps:
-    - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v3
+    - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v3
     - uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v4
       with:
         go-version: stable
diff --git a/.github/workflows/depsreview.yaml b/.github/workflows/depsreview.yaml
index 94809496e2c..1f8897db6c9 100644
--- a/.github/workflows/depsreview.yaml
+++ b/.github/workflows/depsreview.yaml
@@ -8,7 +8,7 @@ jobs:
   dependency-review:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v3
+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v3
       - uses: actions/dependency-review-action@v4
         with:
           allow-licenses: BSD-2-Clause, BSD-3-Clause, MIT, Apache-2.0, MPL-2.0, ISC
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index adf60753923..3efde6901eb 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -19,7 +19,7 @@ jobs:
   htmltest:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v3
+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v3
       - uses: cachix/install-nix-action@V27
         with:
           nix_path: nixpkgs=channel:nixos-unstable
diff --git a/.github/workflows/generate.yml b/.github/workflows/generate.yml
index bdc3432ddf0..54d1435ebad 100644
--- a/.github/workflows/generate.yml
+++ b/.github/workflows/generate.yml
@@ -12,7 +12,7 @@ jobs:
       contents: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v3
+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v3
         with:
           token: ${{ secrets.GH_PAT }}
       - uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v4
diff --git a/.github/workflows/gitleaks.yml b/.github/workflows/gitleaks.yml
index 6836004874a..bdbf60d3b0f 100644
--- a/.github/workflows/gitleaks.yml
+++ b/.github/workflows/gitleaks.yml
@@ -14,7 +14,7 @@ jobs:
   gitleaks:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v3
+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v3
         with:
           fetch-depth: 0
       - uses: gitleaks/gitleaks-action@v2
diff --git a/.github/workflows/grype.yml b/.github/workflows/grype.yml
index 173b9404f17..30dd49cf737 100644
--- a/.github/workflows/grype.yml
+++ b/.github/workflows/grype.yml
@@ -17,7 +17,7 @@ jobs:
       contents: read
 
     steps:
-    - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v3
+    - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v3
     - uses: anchore/scan-action@v3
       with:
         path: "."
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 95422b313bb..77cfa97e2d2 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -17,7 +17,7 @@ jobs:
     name: lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v3
+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v3
       - uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v4
         with:
           go-version: stable
diff --git a/.github/workflows/nightly-oss.yml b/.github/workflows/nightly-oss.yml
index 103d084821f..d9de795322b 100644
--- a/.github/workflows/nightly-oss.yml
+++ b/.github/workflows/nightly-oss.yml
@@ -16,7 +16,7 @@ jobs:
     env:
       DOCKER_CLI_EXPERIMENTAL: "enabled"
     steps:
-      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v3
+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v3
         with:
           fetch-depth: 0
       - uses: arduino/setup-task@b91d5d2c96a56797b48ac1e0e89220bf64044611 # v1
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fc1315deb8c..91993c92df6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -49,7 +49,7 @@ jobs:
       matrix:
         format: [deb, rpm, apk]
     steps:
-      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v3
+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v3
         with:
           fetch-depth: 0
       - uses: arduino/setup-task@b91d5d2c96a56797b48ac1e0e89220bf64044611 # v1
@@ -70,7 +70,7 @@ jobs:
     env:
       DOCKER_CLI_EXPERIMENTAL: "enabled"
     steps:
-      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v3
+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v3
         with:
           fetch-depth: 0
       - uses: arduino/setup-task@b91d5d2c96a56797b48ac1e0e89220bf64044611 # v1