diff --git a/.github/workflows/assembler-preview.yml b/.github/workflows/assembler-preview.yml
index a7b9695b0..79ca0d5e5 100644
--- a/.github/workflows/assembler-preview.yml
+++ b/.github/workflows/assembler-preview.yml
@@ -57,7 +57,7 @@ jobs:
             }
 
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.2
         with:
           ref: ${{ steps.pr-details.outputs.result || github.event.pull_request.head.sha }}
           persist-credentials: false
diff --git a/.github/workflows/build-changelog-scrubber-lambda.yml b/.github/workflows/build-changelog-scrubber-lambda.yml
index 6265d75ce..220f5a65c 100644
--- a/.github/workflows/build-changelog-scrubber-lambda.yml
+++ b/.github/workflows/build-changelog-scrubber-lambda.yml
@@ -22,7 +22,7 @@ jobs:
     env:
       BINARY_PATH: .artifacts/docs-lambda-changelog-scrubber/release_linux-x64/bootstrap
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           ref: ${{ inputs.ref }}
           persist-credentials: false
diff --git a/.github/workflows/build-link-index-updater-lambda.yml b/.github/workflows/build-link-index-updater-lambda.yml
index e2008b0a8..a577c6f94 100644
--- a/.github/workflows/build-link-index-updater-lambda.yml
+++ b/.github/workflows/build-link-index-updater-lambda.yml
@@ -22,7 +22,7 @@ jobs:
     env:
       BINARY_PATH: .artifacts/docs-lambda-index-publisher/release_linux-x64/bootstrap
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with: 
           ref: ${{ inputs.ref }}
           persist-credentials: false
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index abc7e57fd..e3a589301 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,7 +20,7 @@ jobs:
   validate-assembler:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           persist-credentials: false
 
@@ -42,7 +42,7 @@ jobs:
     env:
       MSBuildNoWarn: IDE0032
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           persist-credentials: false
         
@@ -77,7 +77,7 @@ jobs:
       run: 
         working-directory: src/Elastic.Documentation.Site
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           persist-credentials: false
 
@@ -127,7 +127,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           persist-credentials: false
 
@@ -148,7 +148,7 @@ jobs:
          - macos-latest
          - windows-latest
     steps:          
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           persist-credentials: false
       - name: 'Windows only, set TEMP to the same drive'
@@ -201,7 +201,7 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/create-major-tag.yml b/.github/workflows/create-major-tag.yml
index 0269fe9b7..343101b56 100644
--- a/.github/workflows/create-major-tag.yml
+++ b/.github/workflows/create-major-tag.yml
@@ -15,7 +15,7 @@ jobs:
   create-major-tag:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           persist-credentials: true
       - name: Get major version
diff --git a/.github/workflows/docs-preview-local.yml b/.github/workflows/docs-preview-local.yml
index cdc931cbb..6268aca03 100644
--- a/.github/workflows/docs-preview-local.yml
+++ b/.github/workflows/docs-preview-local.yml
@@ -93,7 +93,7 @@ jobs:
     steps:
       - name: Checkout
         if: github.event_name == 'push'
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.2
         with:
           ref: ${{ github.event.pull_request.head.sha || github.ref }}
           persist-credentials: false
@@ -211,7 +211,7 @@ jobs:
         if: >
           env.MATCH == 'true'
           && needs.check.outputs.any_modified != 'false'
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.2
         with:
           ref: ${{ github.event.pull_request.head.sha || github.ref }}
           persist-credentials: false
diff --git a/.github/workflows/license.yml b/.github/workflows/license.yml
index 0ae71ac31..4b1e805a5 100644
--- a/.github/workflows/license.yml
+++ b/.github/workflows/license.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/prerelease.yml b/.github/workflows/prerelease.yml
index 56244eeb4..b170088ae 100644
--- a/.github/workflows/prerelease.yml
+++ b/.github/workflows/prerelease.yml
@@ -27,7 +27,7 @@ jobs:
     steps:
       - id: repo-basename
         run: 'echo "value=`basename ${{ github.repository }}`" >> $GITHUB_OUTPUT'
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           persist-credentials: false
       - name: Setup Pages
@@ -56,7 +56,7 @@ jobs:
       major-version: ${{ steps.bootstrap.outputs.major-version }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c23904ed2..ade452057 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -53,7 +53,7 @@ jobs:
       major-version: ${{ steps.bootstrap.outputs.major-version }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           ref: ${{ needs.release-drafter.outputs.tag_name }}
           persist-credentials: false
@@ -188,7 +188,7 @@ jobs:
       major-version: ${{ steps.bootstrap.outputs.major-version }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           ref: ${{ needs.release-drafter.outputs.tag_name }}
           persist-credentials: false
diff --git a/.github/workflows/required-labels.yml b/.github/workflows/required-labels.yml
index 13c0bb56c..0d84967ea 100644
--- a/.github/workflows/required-labels.yml
+++ b/.github/workflows/required-labels.yml
@@ -18,7 +18,7 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           persist-credentials: false
       - name: Wait for PR to be ready (if just opened)
diff --git a/.github/workflows/smoke-test.yml b/.github/workflows/smoke-test.yml
index a2b5b3ae7..473793ac8 100644
--- a/.github/workflows/smoke-test.yml
+++ b/.github/workflows/smoke-test.yml
@@ -26,13 +26,13 @@ jobs:
             landing-page-path-output: ""
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           persist-credentials: false
       - name: Bootstrap Action Workspace
         uses: ./.github/actions/bootstrap
         
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           repository: ${{ matrix.repository }}
           path: test-repo
diff --git a/.github/workflows/updatecli.yml b/.github/workflows/updatecli.yml
index e4b286bcb..d0ca2b9cd 100644
--- a/.github/workflows/updatecli.yml
+++ b/.github/workflows/updatecli.yml
@@ -16,7 +16,7 @@ jobs:
   bump:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 6d3562186..10c743a3c 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -16,7 +16,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.2
         with:
           persist-credentials: false