diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml
index 85d24c5a3e..7a2afbea18 100644
--- a/.github/workflows/android.yml
+++ b/.github/workflows/android.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest-8-cores
 
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       # gh api repos/actions/checkout/commits/v6 --jq '.sha'
       with:
           submodules: true
diff --git a/.github/workflows/diffuse.yml b/.github/workflows/diffuse.yml
index 57faed6b28..47780cca02 100644
--- a/.github/workflows/diffuse.yml
+++ b/.github/workflows/diffuse.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest-8-cores
 
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       # gh api repos/actions/checkout/commits/v6 --jq '.sha'
       with:
         submodules: true
@@ -61,7 +61,7 @@ jobs:
       if: steps.cache-base.outputs.cache-hit != 'true'
       run: mv app/build/outputs/apk/playProd/release/*arm64*.apk diffuse-base.apk
 
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       # gh api repos/actions/checkout/commits/v6 --jq '.sha'
       with:
         submodules: true
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 365a07f6d9..6a77891a1c 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -11,7 +11,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         # gh api repos/actions/checkout/commits/v6 --jq '.sha'
       - name: Build image
         run: |