diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 6b7f447..ceb5401 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -14,6 +14,7 @@ env:
   UP_API_TOKEN: ${{ secrets.UP_API_TOKEN }}
   UP_ROBOT_ID: ${{ secrets.UP_ROBOT_ID }}
   UP_ORG: ${{ secrets.UP_ORG }}
+  XPKG_REGISTRY: xpkg.upbound.io
 
 jobs:
   deploy:
@@ -21,7 +22,7 @@ jobs:
     steps:
       - name: Checkout
         id: checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
 
       - name: Install and login with up
         if: env.UP_API_TOKEN != '' && env.UP_ORG != ''
@@ -32,9 +33,9 @@ jobs:
 
       # doesn't work with plain token when pushing otherwise
       - name: Login to xpkg with robot
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
         with:
-          registry: xpkg.upbound.io
+          registry: ${{ env.XPKG_REGISTRY }}
           username: ${{ env.UP_ROBOT_ID }}
           password: ${{ env.UP_API_TOKEN }}
 
@@ -46,3 +47,10 @@ jobs:
           tag: ${{ inputs.version || '' }}
           # login-check does `up org list` which doesn't work with a robot-token
           skip-login-check: true
+
+      - name: Append icon overlay to package
+        if: env.UP_API_TOKEN != '' && hashFiles('./extensions') != '' && inputs.version != ''
+        run: |
+          PROJECT_NAME=$(yq '.metadata.name' upbound.yaml)
+          PACKAGE_REF="${{ env.XPKG_REGISTRY }}/${{ env.UP_ORG }}/${PROJECT_NAME}:${{ inputs.version }}"
+          up alpha xpkg append --extensions-root=./extensions ${PACKAGE_REF}
diff --git a/.github/workflows/composition-tests.yaml b/.github/workflows/composition-tests.yaml
index 5bd6cbe..4529df0 100644
--- a/.github/workflows/composition-tests.yaml
+++ b/.github/workflows/composition-tests.yaml
@@ -12,7 +12,7 @@ jobs:
     steps:
       - name: Checkout
         id: checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
 
       - name: Install up
         uses: upbound/action-up@53fe6395637d884c80d2bbc8c2d75d0ece776ced # v1
diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml
index 6802fb3..f6f965d 100644
--- a/.github/workflows/e2e.yaml
+++ b/.github/workflows/e2e.yaml
@@ -22,7 +22,7 @@ jobs:
     steps:
       - name: Checkout
         id: checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
@@ -35,7 +35,7 @@ jobs:
 
       # doesn't work with plain token when pushing otherwise
       - name: Login to xpkg with robot
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
         with:
           registry: xpkg.upbound.io
           username: ${{ env.UP_ROBOT_ID }}
diff --git a/.github/workflows/tag.yml b/.github/workflows/tag.yml
index 4c9f1ea..f29d12e 100644
--- a/.github/workflows/tag.yml
+++ b/.github/workflows/tag.yml
@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
 
       - name: Create Tag
         uses: negz/create-tag@39bae1e0932567a58c20dea5a1a0d18358503320 # v1
diff --git a/.github/workflows/yamllint.yaml b/.github/workflows/yamllint.yaml
index f159c49..be2ab4d 100644
--- a/.github/workflows/yamllint.yaml
+++ b/.github/workflows/yamllint.yaml
@@ -5,7 +5,7 @@ jobs:
     name: runner / yamllint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
       - name: yamllint
         uses: reviewdog/action-yamllint@f01d8a48fd8d89f89895499fca2cff09f9e9e8c0 # v1.21.0
         with: