diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index 7751ba7c..85faa983 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -19,7 +19,7 @@ jobs:
       packages: ${{ steps.changed.outputs.packages }}
       extensions: ${{ steps.changed.outputs.extensions }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # ratchet:actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           fetch-depth: 0
 
@@ -63,7 +63,7 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # ratchet:actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # ratchet:shivammathur/setup-php@v2
         with:
diff --git a/.github/workflows/split-dev.yml b/.github/workflows/split-dev.yml
index c034773a..bd55256a 100644
--- a/.github/workflows/split-dev.yml
+++ b/.github/workflows/split-dev.yml
@@ -34,7 +34,7 @@ jobs:
           echo "::error::main is published by the regular Split workflow — dispatch this on a feature branch"
           exit 1
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # ratchet:actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           fetch-depth: 0
           # the persisted GITHUB_TOKEN header would override the app token on push
diff --git a/.github/workflows/split.yml b/.github/workflows/split.yml
index 2304b8a1..434a7947 100644
--- a/.github/workflows/split.yml
+++ b/.github/workflows/split.yml
@@ -17,7 +17,7 @@ jobs:
   split:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # ratchet:actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           fetch-depth: 0
           # the persisted GITHUB_TOKEN header would override the app token on push
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 320be5fd..c0cba41f 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -17,7 +17,7 @@ jobs:
     outputs:
       matrix: ${{ steps.changed.outputs.matrix }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # ratchet:actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           fetch-depth: 0
 
@@ -72,7 +72,7 @@ jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # ratchet:actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       - run: bin/monorepo validate
       - name: Enforce pinned workflow actions
         run: >
@@ -97,7 +97,7 @@ jobs:
       matrix:
         include: ${{ fromJson(needs.changed.outputs.matrix) }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # ratchet:actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - id: meta
         run: |