diff --git a/.github/workflows/_terraform-layer.yaml b/.github/workflows/_terraform-layer.yaml
index 7e54d53..77cc63d 100644
--- a/.github/workflows/_terraform-layer.yaml
+++ b/.github/workflows/_terraform-layer.yaml
@@ -53,7 +53,7 @@ jobs:
 
     steps:
       - name: Checkout Code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Read secrets from Vault
         uses: hashicorp/vault-action@892a26828f195e65540a40b4768ae4571f51ebfc # v4.0.0
diff --git a/.github/workflows/charts-validate.yaml b/.github/workflows/charts-validate.yaml
index f0c5527..1d081d1 100644
--- a/.github/workflows/charts-validate.yaml
+++ b/.github/workflows/charts-validate.yaml
@@ -28,7 +28,7 @@ jobs:
     outputs:
       charts: ${{ steps.find.outputs.charts }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           fetch-depth: 0 # need history to diff against the PR base
 
@@ -86,7 +86,7 @@ jobs:
       matrix:
         chart: ${{ fromJSON(needs.discover.outputs.charts) }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
 
@@ -147,7 +147,7 @@ jobs:
     needs: render
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
 
diff --git a/.github/workflows/cloud-edge-deploy.yaml b/.github/workflows/cloud-edge-deploy.yaml
index 3267907..b7a5d34 100644
--- a/.github/workflows/cloud-edge-deploy.yaml
+++ b/.github/workflows/cloud-edge-deploy.yaml
@@ -58,7 +58,7 @@ jobs:
       nixos: ${{ steps.filter.outputs.nixos }}
       workflow_logic: ${{ steps.filter.outputs.workflow_logic }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4
         id: filter
         with:
@@ -98,7 +98,7 @@ jobs:
       REPLACE_TARGET: ${{ github.event_name == 'workflow_dispatch' && inputs.replace_target || '' }}
 
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Read secrets from Vault
         uses: hashicorp/vault-action@892a26828f195e65540a40b4768ae4571f51ebfc # v4.0.0
@@ -181,7 +181,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Validate workflow helper script syntax
         run: bash -n ./cloud-edge/scripts/gha/cloud-edge-workflow.sh
@@ -247,7 +247,7 @@ jobs:
       cancel-in-progress: false
 
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Install Nix
         uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31
diff --git a/.github/workflows/docs-diagrams.yaml b/.github/workflows/docs-diagrams.yaml
index ccfb37a..64bb40b 100644
--- a/.github/workflows/docs-diagrams.yaml
+++ b/.github/workflows/docs-diagrams.yaml
@@ -21,7 +21,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           ref: ${{ github.head_ref }}
 
diff --git a/.github/workflows/minerva-deploy.yaml b/.github/workflows/minerva-deploy.yaml
index de31e50..cac53e5 100644
--- a/.github/workflows/minerva-deploy.yaml
+++ b/.github/workflows/minerva-deploy.yaml
@@ -21,7 +21,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Mint minerva tailnet key
         id: ts_authkey
diff --git a/.github/workflows/repo-lint.yaml b/.github/workflows/repo-lint.yaml
index 6a998c6..edaf4c7 100644
--- a/.github/workflows/repo-lint.yaml
+++ b/.github/workflows/repo-lint.yaml
@@ -21,5 +21,5 @@ jobs:
       # terraform_* handled in terraform-lint; gitleaks handled in security-trivy
       SKIP: terraform_fmt,terraform_validate,terraform_tflint,terraform_trivy,gitleaks
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
diff --git a/.github/workflows/security-trivy.yaml b/.github/workflows/security-trivy.yaml
index 494ea59..0c140cf 100644
--- a/.github/workflows/security-trivy.yaml
+++ b/.github/workflows/security-trivy.yaml
@@ -23,7 +23,7 @@ jobs:
     name: "Secrets"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Trivy scan (Secrets)
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
@@ -67,7 +67,7 @@ jobs:
             category: "trivy-compose"
 
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Trivy scan (${{ matrix.target }})
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
diff --git a/.github/workflows/ssh-cert-converge.yaml b/.github/workflows/ssh-cert-converge.yaml
index 9b8c278..870b13a 100644
--- a/.github/workflows/ssh-cert-converge.yaml
+++ b/.github/workflows/ssh-cert-converge.yaml
@@ -42,7 +42,7 @@ jobs:
 
     steps:
       - name: Checkout Code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Read secrets from Vault
         uses: hashicorp/vault-action@892a26828f195e65540a40b4768ae4571f51ebfc # v4.0.0
@@ -160,7 +160,7 @@ jobs:
 
     steps:
       - name: Checkout Code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Read secrets from Vault
         uses: hashicorp/vault-action@892a26828f195e65540a40b4768ae4571f51ebfc # v4.0.0
diff --git a/.github/workflows/tailscale-deploy.yaml b/.github/workflows/tailscale-deploy.yaml
index 15209f7..fccbd42 100644
--- a/.github/workflows/tailscale-deploy.yaml
+++ b/.github/workflows/tailscale-deploy.yaml
@@ -43,7 +43,7 @@ jobs:
 
     steps:
       - name: Checkout Code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Setup Terraform + AWS
         uses: ./.github/actions/tf-aws-setup
diff --git a/.github/workflows/terraform-lint.yaml b/.github/workflows/terraform-lint.yaml
index 8a0509f..7c3f05f 100644
--- a/.github/workflows/terraform-lint.yaml
+++ b/.github/workflows/terraform-lint.yaml
@@ -41,7 +41,7 @@ jobs:
     name: "fmt"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4
         with:
@@ -68,7 +68,7 @@ jobs:
           - vault
           - tailscale
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Setup TFLint
         uses: terraform-linters/setup-tflint@6e1e0642c0289bd619021bf6b34e3c08ed1e005a # v6.3.0
diff --git a/.github/workflows/vault-deploy.yaml b/.github/workflows/vault-deploy.yaml
index ce6c85c..97d3b65 100644
--- a/.github/workflows/vault-deploy.yaml
+++ b/.github/workflows/vault-deploy.yaml
@@ -37,7 +37,7 @@ jobs:
 
     steps:
       - name: Checkout Code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Setup Terraform + AWS
         uses: ./.github/actions/tf-aws-setup
diff --git a/.github/workflows/vieta-deploy.yaml b/.github/workflows/vieta-deploy.yaml
index 26c8fd1..fd1fe69 100644
--- a/.github/workflows/vieta-deploy.yaml
+++ b/.github/workflows/vieta-deploy.yaml
@@ -58,7 +58,7 @@ jobs:
       infra: ${{ steps.filter.outputs.infra }}
       services: ${{ steps.filter.outputs.services }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4
         id: filter
         with: