diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 029c40b8..f03fe313 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -38,7 +38,7 @@ jobs:
     runs-on: ${{ matrix.platform }}
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           submodules: true
 
diff --git a/.github/workflows/ci_cov.yaml b/.github/workflows/ci_cov.yaml
index 8960f9b4..a14a4992 100644
--- a/.github/workflows/ci_cov.yaml
+++ b/.github/workflows/ci_cov.yaml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ${{ matrix.platform }}
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           submodules: true
 
diff --git a/.github/workflows/ci_windows.yaml b/.github/workflows/ci_windows.yaml
index a49f7f1f..ae270112 100644
--- a/.github/workflows/ci_windows.yaml
+++ b/.github/workflows/ci_windows.yaml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ${{ matrix.platform }}
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           submodules: false
 
diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index d7c36f2b..fc1b4bc3 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -29,7 +29,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           # Use base.sha, not head.sha: checking out fork code under
           # pull_request_target would give untrusted code access to secrets.
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 282eece7..42c72bcd 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -26,7 +26,7 @@ jobs:
       actions: read # Required for Claude to read CI results on PRs
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml
index 415f1575..75b68e36 100644
--- a/.github/workflows/docs.yaml
+++ b/.github/workflows/docs.yaml
@@ -19,7 +19,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/links.yaml b/.github/workflows/links.yaml
index b1ba91c4..b63dab7f 100644
--- a/.github/workflows/links.yaml
+++ b/.github/workflows/links.yaml
@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Install uv
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
diff --git a/.github/workflows/mdformat.yaml b/.github/workflows/mdformat.yaml
index b5492e72..e132c6b8 100644
--- a/.github/workflows/mdformat.yaml
+++ b/.github/workflows/mdformat.yaml
@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Install uv
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
diff --git a/.github/workflows/notebook_tests.yaml b/.github/workflows/notebook_tests.yaml
index 6a1993dd..369bf03e 100644
--- a/.github/workflows/notebook_tests.yaml
+++ b/.github/workflows/notebook_tests.yaml
@@ -28,7 +28,7 @@ jobs:
         python-version: ["3.10", "3.13"]
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           submodules: true
 
diff --git a/.github/workflows/ruff.yaml b/.github/workflows/ruff.yaml
index 54a0272f..fa0e4a93 100644
--- a/.github/workflows/ruff.yaml
+++ b/.github/workflows/ruff.yaml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Install uv
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
diff --git a/.github/workflows/spec_tests.yaml b/.github/workflows/spec_tests.yaml
index 10d7dd25..3daba850 100644
--- a/.github/workflows/spec_tests.yaml
+++ b/.github/workflows/spec_tests.yaml
@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Checkout hed-python
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           submodules: true
 
diff --git a/.github/workflows/test_installer.yaml b/.github/workflows/test_installer.yaml
index 67e65fd1..815ed69c 100644
--- a/.github/workflows/test_installer.yaml
+++ b/.github/workflows/test_installer.yaml
@@ -16,7 +16,7 @@ jobs:
         python-version: ["3.10", "3.13"]
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - name: Install uv
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
         with:
diff --git a/.github/workflows/typos.yaml b/.github/workflows/typos.yaml
index 8fac2cb6..31174a8b 100644
--- a/.github/workflows/typos.yaml
+++ b/.github/workflows/typos.yaml
@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Install uv
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0