diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9714b75..36dd83a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,7 +18,7 @@ jobs:
     name: quality
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           # No step pushes via git — releases use `gh` with GITHUB_TOKEN — so
           # don't leave the checkout token in .git/config for build subprocesses.
@@ -71,7 +71,7 @@ jobs:
       EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
       CONVEX_DEPLOY_KEY: ${{ secrets.CONVEX_DEPLOY_KEY }}
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           # No step pushes via git — releases use `gh` with GITHUB_TOKEN — so
           # don't leave the checkout token in .git/config for build subprocesses.
@@ -243,7 +243,7 @@ jobs:
     name: desktop quality
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           # No step pushes via git — releases use `gh` with GITHUB_TOKEN — so
           # don't leave the checkout token in .git/config for build subprocesses.
@@ -310,7 +310,7 @@ jobs:
       GOOGLE_DESKTOP_CLIENT_ID: ${{ vars.GOOGLE_DESKTOP_CLIENT_ID }}
       GOOGLE_DESKTOP_CLIENT_SECRET: ${{ secrets.GOOGLE_DESKTOP_CLIENT_SECRET }}
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           # No step pushes via git — releases use `gh` with GITHUB_TOKEN — so
           # don't leave the checkout token in .git/config for build subprocesses.