diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index ea49990f445c..5073d4ff1ad5 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -14,7 +14,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.2
         with:
           fetch-depth: 1
           submodules: true
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 6d48ff68da34..0e2841771a95 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -17,7 +17,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.2
         with:
           fetch-depth: 1
           submodules: true
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 1daa12bf5164..b4ac737e92dd 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.2
         with:
           fetch-depth: 1
           submodules: true
diff --git a/.github/workflows/pr-build.yml b/.github/workflows/pr-build.yml
index 5b517c384241..b78ccfbdf5bd 100644
--- a/.github/workflows/pr-build.yml
+++ b/.github/workflows/pr-build.yml
@@ -13,7 +13,7 @@ jobs:
     if: ${{ github.event.pull_request.head.repo.fork || github.triggering_actor == 'dependabot[bot]' }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.2
         with:
           fetch-depth: 1
           submodules: true
diff --git a/.github/workflows/pr-preview.yml b/.github/workflows/pr-preview.yml
index 43b31a90d46d..3f212defe941 100644
--- a/.github/workflows/pr-preview.yml
+++ b/.github/workflows/pr-preview.yml
@@ -20,7 +20,7 @@ jobs:
           client-id: ${{ vars.THEOPLAYER_BOT_CLIENT_ID }}
           private-key: ${{ secrets.THEOPLAYER_BOT_PRIVATE_KEY }}
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.2
         with:
           token: ${{ steps.app-token.outputs.token }}
           fetch-depth: 1
diff --git a/.github/workflows/theoplayer-release.yml b/.github/workflows/theoplayer-release.yml
index bd4d87072eb7..cc867ff7a749 100644
--- a/.github/workflows/theoplayer-release.yml
+++ b/.github/workflows/theoplayer-release.yml
@@ -14,7 +14,7 @@ jobs:
           client-id: ${{ vars.THEOPLAYER_BOT_CLIENT_ID }}
           private-key: ${{ secrets.THEOPLAYER_BOT_PRIVATE_KEY }}
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.2
         with:
           token: ${{ steps.app-token.outputs.token }}
           fetch-depth: 1
diff --git a/.github/workflows/update-submodules.yml b/.github/workflows/update-submodules.yml
index 4fae66ec7177..15afb031efe1 100644
--- a/.github/workflows/update-submodules.yml
+++ b/.github/workflows/update-submodules.yml
@@ -23,7 +23,7 @@ jobs:
           client-id: ${{ vars.THEOPLAYER_BOT_CLIENT_ID }}
           private-key: ${{ secrets.THEOPLAYER_BOT_PRIVATE_KEY }}
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.2
         with:
           token: ${{ steps.app-token.outputs.token }}
           fetch-depth: 1
diff --git a/.github/workflows/update-theolive-changelog.yml b/.github/workflows/update-theolive-changelog.yml
index 47af3d84fff4..485bf1150d9b 100644
--- a/.github/workflows/update-theolive-changelog.yml
+++ b/.github/workflows/update-theolive-changelog.yml
@@ -22,7 +22,7 @@ jobs:
           client-id: ${{ vars.THEOPLAYER_BOT_CLIENT_ID }}
           private-key: ${{ secrets.THEOPLAYER_BOT_PRIVATE_KEY }}
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.2
         with:
           token: ${{ steps.app-token.outputs.token }}
           fetch-depth: 1