diff --git a/.github/workflows/allow-deploys.yml b/.github/workflows/allow-deploys.yml
index ef93eed..5f4e213 100644
--- a/.github/workflows/allow-deploys.yml
+++ b/.github/workflows/allow-deploys.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: linux-arm64
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       # Enable CD on merge to main
       - name: Enable ${{ inputs.workflow }} workflow
diff --git a/.github/workflows/block-deploys.yml b/.github/workflows/block-deploys.yml
index 2d577cb..aff3603 100644
--- a/.github/workflows/block-deploys.yml
+++ b/.github/workflows/block-deploys.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: linux-arm64
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       # Disable CD on merge to main
       - name: Disable ${{ inputs.workflow }} workflow
diff --git a/.github/workflows/code-coverage-kotlin.yml b/.github/workflows/code-coverage-kotlin.yml
index 4821ce3..c98eeab 100644
--- a/.github/workflows/code-coverage-kotlin.yml
+++ b/.github/workflows/code-coverage-kotlin.yml
@@ -105,7 +105,7 @@ jobs:
     timeout-minutes: ${{ inputs.test-timeout-minutes }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       - name: Validate service-name format
         run: |
           if ! echo "${{ inputs.service-name }}" | grep -qE '^[a-z0-9]+(-[a-z0-9]+)*$'; then
@@ -143,7 +143,7 @@ jobs:
     runs-on: linux-arm64
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       - name: Check if can access Dev Lens
         run: |
           curl --retry 3 --retry-delay 5 --retry-all-errors -f -s -o /dev/null --max-time 30 https://dev-lens.staging.monta.app/health
diff --git a/.github/workflows/component-build.yml b/.github/workflows/component-build.yml
index 072b84b..bc596d7 100644
--- a/.github/workflows/component-build.yml
+++ b/.github/workflows/component-build.yml
@@ -100,7 +100,7 @@ jobs:
       image-tag: ${{ inputs.git-sha || github.sha }}
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           ref: ${{ inputs.git-sha || github.sha }}
       - name: Get runner name
@@ -119,7 +119,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           ref: ${{ inputs.git-sha || github.sha }}
       - name: Configure AWS credentials via assumed role
@@ -182,7 +182,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           ref: ${{ inputs.git-sha || github.sha }}
       - name: Configure AWS credentials via assumed role
diff --git a/.github/workflows/component-deploy-v2.yml b/.github/workflows/component-deploy-v2.yml
index e8d898f..ceedef3 100644
--- a/.github/workflows/component-deploy-v2.yml
+++ b/.github/workflows/component-deploy-v2.yml
@@ -96,7 +96,7 @@ jobs:
       deployment-url: ${{ steps.argocd-sync.outputs.deployment-url }}
     steps:
       - name: Check out service repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           repository: monta-app/${{ inputs.repository-name || format('service-{0}', inputs.service-identifier) }}
           path: 'service-repo'
diff --git a/.github/workflows/component-deploy.yml b/.github/workflows/component-deploy.yml
index a588bcf..e9c6b4a 100644
--- a/.github/workflows/component-deploy.yml
+++ b/.github/workflows/component-deploy.yml
@@ -84,7 +84,7 @@ jobs:
       deployment-url: ${{ steps.argocd-sync.outputs.deployment-url }}
     steps:
       - name: Check out manifest repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           repository: monta-app/kube-manifests
           path: 'manifests'
diff --git a/.github/workflows/component-service-profile-kotlin.yml b/.github/workflows/component-service-profile-kotlin.yml
index 28dcd45..c762d60 100644
--- a/.github/workflows/component-service-profile-kotlin.yml
+++ b/.github/workflows/component-service-profile-kotlin.yml
@@ -51,7 +51,7 @@ jobs:
     runs-on: linux-arm64
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       - name: Set up JDK
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
         with:
@@ -124,7 +124,7 @@ jobs:
               {"condition": {"method": "OPTIONS"}, "name": "OPTIONS [Default]"}
             ]' > service-profile.yml
       - name: Check out manifest repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           path: 'manifests'
           repository: monta-app/kube-manifests
diff --git a/.github/workflows/component-test-kotlin.yml b/.github/workflows/component-test-kotlin.yml
index 84a8d6a..6d19533 100644
--- a/.github/workflows/component-test-kotlin.yml
+++ b/.github/workflows/component-test-kotlin.yml
@@ -65,7 +65,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       - name: Set up JDK
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
         with:
diff --git a/.github/workflows/component-test-python.yml b/.github/workflows/component-test-python.yml
index 7b7db72..5446781 100644
--- a/.github/workflows/component-test-python.yml
+++ b/.github/workflows/component-test-python.yml
@@ -67,7 +67,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       - name: Setup Docker Compose
         if: ${{ inputs.docker-compose-path }}
         uses: monta-app/github-workflows/.github/actions/docker-compose-setup@main
diff --git a/.github/workflows/create-release-tag.yml b/.github/workflows/create-release-tag.yml
index 45d2758..9666908 100644
--- a/.github/workflows/create-release-tag.yml
+++ b/.github/workflows/create-release-tag.yml
@@ -17,7 +17,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/publish-tech-docs.yml b/.github/workflows/publish-tech-docs.yml
index e2f48bf..e5e65e7 100644
--- a/.github/workflows/publish-tech-docs.yml
+++ b/.github/workflows/publish-tech-docs.yml
@@ -26,7 +26,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
diff --git a/.github/workflows/pull-request-bun.yml b/.github/workflows/pull-request-bun.yml
index e924f1a..8a5150d 100644
--- a/.github/workflows/pull-request-bun.yml
+++ b/.github/workflows/pull-request-bun.yml
@@ -77,7 +77,7 @@ jobs:
     timeout-minutes: ${{ inputs.build-timeout-minutes }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
diff --git a/.github/workflows/pull-request-kotlin.yml b/.github/workflows/pull-request-kotlin.yml
index 2372abd..a1bc150 100644
--- a/.github/workflows/pull-request-kotlin.yml
+++ b/.github/workflows/pull-request-kotlin.yml
@@ -101,7 +101,7 @@ jobs:
     timeout-minutes: ${{ inputs.test-timeout-minutes }}
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           # to check out the actual pull request commit, not the merge commit
           ref: ${{ github.event.pull_request.head.sha }}
@@ -141,7 +141,7 @@ jobs:
     steps:
       # Checkout
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           # to check out the actual pull request commit, not the merge commit
           ref: ${{ github.event.pull_request.head.sha }}
diff --git a/.github/workflows/pull-request-react.yml b/.github/workflows/pull-request-react.yml
index d1ca934..4211762 100644
--- a/.github/workflows/pull-request-react.yml
+++ b/.github/workflows/pull-request-react.yml
@@ -83,7 +83,7 @@ jobs:
     timeout-minutes: ${{ inputs.build-timeout-minutes }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
index 5c65fd4..dc38a6f 100644
--- a/.github/workflows/pull-request.yml
+++ b/.github/workflows/pull-request.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: linux-arm64
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Run actionlint
         uses: reviewdog/action-actionlint@6fb7acc99f4a1008869fa8a0f09cfca740837d9d # v1
diff --git a/.github/workflows/rollback.yml b/.github/workflows/rollback.yml
index 3035887..3db0ca0 100644
--- a/.github/workflows/rollback.yml
+++ b/.github/workflows/rollback.yml
@@ -53,7 +53,7 @@ jobs:
     if: ${{ !inputs.dry-run }}
     runs-on: linux-arm64
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       - name: Slack Notification
         uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58 # v2
         env:
@@ -82,7 +82,7 @@ jobs:
     runs-on: linux-arm64
     steps:
       - name: Checkout branch
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           fetch-depth: 2
 
@@ -96,7 +96,7 @@ jobs:
           echo "rollback_commit_sha=$ROLLBACK_COMMIT_SHA" >> "$GITHUB_OUTPUT"
 
       - name: Check out kube-manifests
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           repository: monta-app/kube-manifests
           path: 'kube-manifests'
diff --git a/.github/workflows/semgrep-security-scan.yml b/.github/workflows/semgrep-security-scan.yml
index a079614..6c4704a 100644
--- a/.github/workflows/semgrep-security-scan.yml
+++ b/.github/workflows/semgrep-security-scan.yml
@@ -28,7 +28,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/sonar-cloud.yml b/.github/workflows/sonar-cloud.yml
index b6df652..d99ecbd 100644
--- a/.github/workflows/sonar-cloud.yml
+++ b/.github/workflows/sonar-cloud.yml
@@ -72,7 +72,7 @@ jobs:
     env:
       TAILSCALE_AUTHKEY: ${{ secrets.TAILSCALE_AUTHKEY }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           # Shallow clones should be disabled for a better relevancy of analysis
           fetch-depth: 0
diff --git a/.github/workflows/track-pending-release.yml b/.github/workflows/track-pending-release.yml
index b82bf68..5cd90b2 100644
--- a/.github/workflows/track-pending-release.yml
+++ b/.github/workflows/track-pending-release.yml
@@ -21,7 +21,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           fetch-depth: 0  # Need full history for comparison