diff --git a/.github/workflows/act-image-repin.yml b/.github/workflows/act-image-repin.yml
index 7048d89a..3d438376 100644
--- a/.github/workflows/act-image-repin.yml
+++ b/.github/workflows/act-image-repin.yml
@@ -43,7 +43,7 @@ jobs:
       GH_TOKEN: ${{ github.token }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
       - name: Resolve current upstream digest
         id: resolve
diff --git a/.github/workflows/action-pins.yml b/.github/workflows/action-pins.yml
index 8ff2d94b..33ec1dca 100644
--- a/.github/workflows/action-pins.yml
+++ b/.github/workflows/action-pins.yml
@@ -46,7 +46,7 @@ jobs:
     if: ${{ inputs.run_anchor }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
       - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: return
diff --git a/.github/workflows/auto-promote.yaml b/.github/workflows/auto-promote.yaml
index 560b57e6..f50f03a8 100644
--- a/.github/workflows/auto-promote.yaml
+++ b/.github/workflows/auto-promote.yaml
@@ -60,7 +60,7 @@ jobs:
       # repo content, and the script reads its marker files from the workspace
       # root where download-artifact places them.
       - name: Check out auto-promote decision script
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           sparse-checkout: |
             .github/scripts/auto-promote-resolve.sh
@@ -104,7 +104,7 @@ jobs:
       contents: write
       actions: write
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/build-cli.yaml b/.github/workflows/build-cli.yaml
index 2a95c266..03887890 100644
--- a/.github/workflows/build-cli.yaml
+++ b/.github/workflows/build-cli.yaml
@@ -24,7 +24,7 @@ jobs:
     name: Build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 018602c8..f5d964be 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -21,7 +21,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
diff --git a/.github/workflows/docs-deploy.yaml b/.github/workflows/docs-deploy.yaml
index 842dcc73..7ef2070c 100644
--- a/.github/workflows/docs-deploy.yaml
+++ b/.github/workflows/docs-deploy.yaml
@@ -35,7 +35,7 @@ jobs:
       run:
         working-directory: docs
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "22"
diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml
index d05cdd7d..961b06e0 100644
--- a/.github/workflows/e2e.yaml
+++ b/.github/workflows/e2e.yaml
@@ -63,7 +63,7 @@ jobs:
     outputs:
       code: ${{ steps.compute.outputs.code }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
       - id: filter
         if: github.event_name == 'pull_request'
@@ -146,7 +146,7 @@ jobs:
         # when the workflow_dispatch `shard` input collapses the matrix.
         shard: ${{ fromJSON(needs.plan.outputs.shards) }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           # workflow_dispatch: honour the explicit ref input.
           # All other triggers (push:tags, merge_group): use the exact SHA
diff --git a/.github/workflows/fleet-e2e.yaml b/.github/workflows/fleet-e2e.yaml
index fa10c606..e8ac0a36 100644
--- a/.github/workflows/fleet-e2e.yaml
+++ b/.github/workflows/fleet-e2e.yaml
@@ -332,7 +332,7 @@ jobs:
       contents: read
       actions: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
       - name: Dispatch and watch primary
         uses: ./.github/actions/dispatch-suite
         with:
@@ -359,7 +359,7 @@ jobs:
       matrix:
         repo: ${{ fromJSON(needs.plan.outputs.dependents_repos) }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
       - name: Dispatch and watch
         uses: ./.github/actions/dispatch-suite
         with:
@@ -382,7 +382,7 @@ jobs:
       contents: read
       actions: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
       - name: Dispatch and watch 4env
         uses: ./.github/actions/dispatch-suite
         with:
@@ -416,7 +416,7 @@ jobs:
       matrix:
         repo: ${{ fromJSON(needs.plan.outputs.remainder_repos) }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
       - name: Dispatch and watch
         uses: ./.github/actions/dispatch-suite
         with:
diff --git a/.github/workflows/fleet-reconcile.yaml b/.github/workflows/fleet-reconcile.yaml
index 2574165d..6eefd102 100644
--- a/.github/workflows/fleet-reconcile.yaml
+++ b/.github/workflows/fleet-reconcile.yaml
@@ -110,7 +110,7 @@ jobs:
       # is referenced at a ref by the caller; we re-check-out cascade at that
       # same ref (or an override) so the Go core matches the gate version.
       - name: Check out cascade (reconcile core)
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           repository: stablekernel/cascade
           ref: ${{ inputs.cascade-ref || github.workflow_sha }}
diff --git a/.github/workflows/hotfix.yaml b/.github/workflows/hotfix.yaml
index c67aebb7..72032730 100644
--- a/.github/workflows/hotfix.yaml
+++ b/.github/workflows/hotfix.yaml
@@ -73,7 +73,7 @@ jobs:
       deploy_names: ${{ steps.names.outputs.deploy_names }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           ref: ${{ inputs.hotfix_branch }}
           fetch-depth: 0
@@ -186,7 +186,7 @@ jobs:
       fail-fast: true
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           ref: ${{ inputs.hotfix_branch }}
 
@@ -235,7 +235,7 @@ jobs:
       max-parallel: 3
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           ref: ${{ inputs.hotfix_branch }}
 
@@ -275,7 +275,7 @@ jobs:
       release_url: ${{ steps.release.outputs.html_url }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           ref: ${{ inputs.hotfix_branch }}
           fetch-depth: 0
diff --git a/.github/workflows/nightly-release.yaml b/.github/workflows/nightly-release.yaml
index 68077fe7..0ebaabfa 100644
--- a/.github/workflows/nightly-release.yaml
+++ b/.github/workflows/nightly-release.yaml
@@ -51,7 +51,7 @@ jobs:
     outputs:
       run: ${{ steps.decide.outputs.run }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           # Full history + tags so the last-release ref and the diff resolve.
           fetch-depth: 0
@@ -195,7 +195,7 @@ jobs:
       # The tag is the only carrier that survives the workflow_run boundaries:
       # Release builds it, the (broadened) fleet validates it, and auto-promote's
       # unchanged -rc.-only gate rejects it, so nothing publishes by construction.
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         if: github.event.inputs.dry_run == 'true'
         with:
           fetch-depth: 0
@@ -276,7 +276,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/pin-reconcile.yaml b/.github/workflows/pin-reconcile.yaml
index 40d14f86..12ec7ecf 100644
--- a/.github/workflows/pin-reconcile.yaml
+++ b/.github/workflows/pin-reconcile.yaml
@@ -149,7 +149,7 @@ jobs:
 
       - name: Check out the pull request head
         if: steps.resolve.outputs.proceed == 'true'
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           # The head branch is same-repo (guarded above). Full history lets the
           # non-fast-forward guard compare against the fresh remote tip. The
diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml
index adc86c5e..ced53ce0 100644
--- a/.github/workflows/pr.yaml
+++ b/.github/workflows/pr.yaml
@@ -27,7 +27,7 @@ jobs:
     outputs:
       code: ${{ steps.filter.outputs.code }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
       - id: filter
         uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
@@ -49,7 +49,7 @@ jobs:
     if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
@@ -85,7 +85,7 @@ jobs:
     if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
@@ -107,7 +107,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           # Full history so the reconcile detector can diff base..head to find
           # the changed governed source files a pin bump would land in.
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index b2efa023..3fd647d7 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -39,7 +39,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
       - name: Set up Go
         uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
@@ -63,7 +63,7 @@ jobs:
       id-token: write
       attestations: write
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 5edbd976..6584a4d2 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -19,7 +19,7 @@ jobs:
       actions: read
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/suite-bootstrap-pin.yaml b/.github/workflows/suite-bootstrap-pin.yaml
index 0c3e1f86..ef20239f 100644
--- a/.github/workflows/suite-bootstrap-pin.yaml
+++ b/.github/workflows/suite-bootstrap-pin.yaml
@@ -120,7 +120,7 @@ jobs:
       STATE_TOKEN: ${{ secrets.CASCADE_STATE_TOKEN }}
       TARGET_VERSION: ${{ needs.resolve.outputs.final_version }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
       - name: Configure git identity
         run: |
diff --git a/.github/workflows/validate.yaml b/.github/workflows/validate.yaml
index ae16344d..bf91e366 100644
--- a/.github/workflows/validate.yaml
+++ b/.github/workflows/validate.yaml
@@ -37,7 +37,7 @@ jobs:
     name: Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
@@ -69,7 +69,7 @@ jobs:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
@@ -85,7 +85,7 @@ jobs:
     name: Vulnerability Scan
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with: