diff --git a/.github/workflows/cleanup-storybooks.yml b/.github/workflows/cleanup-storybooks.yml
index 3145b3f7f09..62611fdc016 100644
--- a/.github/workflows/cleanup-storybooks.yml
+++ b/.github/workflows/cleanup-storybooks.yml
@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Checkout gh-pages branch
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           ref: gh-pages
           path: gh-pages
@@ -49,7 +49,7 @@ jobs:
           echo "REMOVED=${REMOVED}" >> "$GITHUB_ENV"
 
       - name: Checkout main branch for scripts
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           path: main-repo
           persist-credentials: false
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index e3ac5bc7886..6883e6ef431 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -37,7 +37,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
 
diff --git a/.github/workflows/deploy-storybooks.yml b/.github/workflows/deploy-storybooks.yml
index 23155ea8f2c..b9bee338f34 100644
--- a/.github/workflows/deploy-storybooks.yml
+++ b/.github/workflows/deploy-storybooks.yml
@@ -23,7 +23,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
           fetch-depth: 0
@@ -101,14 +101,14 @@ jobs:
 
     steps:
       - name: Checkout repository for scripts
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
           path: repo
           persist-credentials: false
 
       - name: Checkout gh-pages branch
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           ref: gh-pages
           path: gh-pages
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index cbe53ecb64b..67bac97b1e6 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -44,7 +44,7 @@ jobs:
     needs:
       - tag
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           ref: ${{ env.GIT_TAG }}
           persist-credentials: false
diff --git a/.github/workflows/l10n-gettext-extract.yml b/.github/workflows/l10n-gettext-extract.yml
index dd9b63a9e90..60c462167d1 100644
--- a/.github/workflows/l10n-gettext-extract.yml
+++ b/.github/workflows/l10n-gettext-extract.yml
@@ -19,13 +19,13 @@ jobs:
         run: |
           yarn global add grunt-cli
       - name: Clone l10n repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           repository: mozilla/fxa-content-server-l10n
           path: 'fxa-l10n'
           persist-credentials: false
       - name: Clone FxA code repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           fetch-depth: 2
           path: 'fxa-code'
diff --git a/.github/workflows/pull-legal-docs.yml b/.github/workflows/pull-legal-docs.yml
index 9bf57fdf2ec..a22884f6f12 100644
--- a/.github/workflows/pull-legal-docs.yml
+++ b/.github/workflows/pull-legal-docs.yml
@@ -14,14 +14,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Clone FxA code repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           path: fxa
           fetch-depth: 2
           persist-credentials: false
 
       - name: Clone legal-docs repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           repository: mozilla/legal-docs
           ref: prod
diff --git a/.github/workflows/tag-release-subplat.yml b/.github/workflows/tag-release-subplat.yml
index 4393f244a44..d73374f5cc4 100644
--- a/.github/workflows/tag-release-subplat.yml
+++ b/.github/workflows/tag-release-subplat.yml
@@ -17,7 +17,7 @@ jobs:
         shell: bash
 
       - name: Check out code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Fetch all git tags
         run: git fetch --tags origin
diff --git a/.github/workflows/tag-release.yml b/.github/workflows/tag-release.yml
index f09b8e937e3..0f317e445d7 100644
--- a/.github/workflows/tag-release.yml
+++ b/.github/workflows/tag-release.yml
@@ -17,7 +17,7 @@ jobs:
         shell: bash
 
       - name: Check out code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Fetch all git tags
         run: git fetch --tags origin
diff --git a/.github/workflows/upload-assets-to-cdn.yml b/.github/workflows/upload-assets-to-cdn.yml
index c1a1edca7ff..264e9f28664 100644
--- a/.github/workflows/upload-assets-to-cdn.yml
+++ b/.github/workflows/upload-assets-to-cdn.yml
@@ -21,7 +21,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false