diff --git a/.github/workflows/black.yml b/.github/workflows/black.yml
index e06dc35b40..94b04f7ab6 100644
--- a/.github/workflows/black.yml
+++ b/.github/workflows/black.yml
@@ -12,7 +12,7 @@ jobs:
   check-with-black:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
       - uses: psf/black@87928e6d6761a4a6d22250e1fee5601b3998086e
diff --git a/.github/workflows/checkbox-beta-release.yml b/.github/workflows/checkbox-beta-release.yml
index 6c24ed9e86..afbca2ea7f 100644
--- a/.github/workflows/checkbox-beta-release.yml
+++ b/.github/workflows/checkbox-beta-release.yml
@@ -24,7 +24,7 @@ jobs:
           sudo apt update -qq
           sudo apt install -qq -y gh
       - name: Checkout checkbox monorepo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -52,7 +52,7 @@ jobs:
           sudo apt update -qq
           sudo apt install -qq -y python3-launchpadlib
       - name: Checkout checkbox monorepo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
       - name: Copy deb packages from edge to beta ppa
diff --git a/.github/workflows/checkbox-ce-oem-daily-builds.yaml b/.github/workflows/checkbox-ce-oem-daily-builds.yaml
index f47cf6e7e9..fd9f74a49b 100644
--- a/.github/workflows/checkbox-ce-oem-daily-builds.yaml
+++ b/.github/workflows/checkbox-ce-oem-daily-builds.yaml
@@ -21,7 +21,7 @@ jobs:
     outputs:
       new_commit_count: ${{ steps.commit_check.outputs.new_commit_count }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/checkbox-ce-oem-daily-cross-builds.yaml b/.github/workflows/checkbox-ce-oem-daily-cross-builds.yaml
index 4feefb6d5f..8c39742071 100644
--- a/.github/workflows/checkbox-ce-oem-daily-cross-builds.yaml
+++ b/.github/workflows/checkbox-ce-oem-daily-cross-builds.yaml
@@ -46,7 +46,7 @@ jobs:
     timeout-minutes: 1200 #20h, this will timeout sooner due to inner timeouts
     name: Frontend ${{ matrix.type }}${{ matrix.release }} (${{ matrix.arch }})
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/checkbox-ce-oem-daily-native-builds.yaml b/.github/workflows/checkbox-ce-oem-daily-native-builds.yaml
index 4dd62d6a8a..b2e8b30eff 100644
--- a/.github/workflows/checkbox-ce-oem-daily-native-builds.yaml
+++ b/.github/workflows/checkbox-ce-oem-daily-native-builds.yaml
@@ -48,7 +48,7 @@ jobs:
     timeout-minutes: 1200 #20h, this will timeout sooner due to inner timeouts
     name: Frontend ${{ matrix.type }}${{ matrix.release }} (${{matrix.arch}})
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/checkbox-ce-oem-edge-builds.yml b/.github/workflows/checkbox-ce-oem-edge-builds.yml
index 2753ad0c99..58e6af83f8 100644
--- a/.github/workflows/checkbox-ce-oem-edge-builds.yml
+++ b/.github/workflows/checkbox-ce-oem-edge-builds.yml
@@ -33,7 +33,7 @@ jobs:
       SNAPCRAFT_BUILDER_ID: checkbox-${{ matrix.type }}${{ matrix.releases }}-${{ github.run_id }}
     name: Frontend ${{ matrix.type }}${{ matrix.releases }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/checkbox-daily-cross-builds.yaml b/.github/workflows/checkbox-daily-cross-builds.yaml
index d6eb5ddd1e..1d8cab23df 100644
--- a/.github/workflows/checkbox-daily-cross-builds.yaml
+++ b/.github/workflows/checkbox-daily-cross-builds.yaml
@@ -41,7 +41,7 @@ jobs:
     timeout-minutes: 1200 #20h, this will timeout sooner due to inner timeouts
     name: Runtime ${{ matrix.release }} (${{ matrix.arch }})
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -127,7 +127,7 @@ jobs:
     timeout-minutes: 1200 #20h, this will timeout sooner due to inner timeouts
     name: Frontend ${{ matrix.type }}${{ matrix.release }} (${{ matrix.arch }})
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/checkbox-daily-native-builds.yaml b/.github/workflows/checkbox-daily-native-builds.yaml
index 5be8a87511..153165aad1 100644
--- a/.github/workflows/checkbox-daily-native-builds.yaml
+++ b/.github/workflows/checkbox-daily-native-builds.yaml
@@ -49,7 +49,7 @@ jobs:
     timeout-minutes: 1200 #20h, this will timeout sooner due to inner timeouts
     name: Runtime ${{ matrix.release }}  (${{matrix.arch}})
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -145,7 +145,7 @@ jobs:
     timeout-minutes: 1200 #20h, this will timeout sooner due to inner timeouts
     name: Frontend ${{ matrix.type }}${{ matrix.release }} (${{matrix.arch}})
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/checkbox-dss-build.yaml b/.github/workflows/checkbox-dss-build.yaml
index e2057f45fb..6a991f47ab 100644
--- a/.github/workflows/checkbox-dss-build.yaml
+++ b/.github/workflows/checkbox-dss-build.yaml
@@ -23,7 +23,7 @@ jobs:
     outputs:
       build_required: ${{ steps.check_diff.outputs.build_required }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -52,7 +52,7 @@ jobs:
     timeout-minutes: 1200 #20h, this will timeout sooner due to inner timeouts
     name: Checkbox DSS validation snap
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/checkbox-promote-beta-to-candidate.yml b/.github/workflows/checkbox-promote-beta-to-candidate.yml
index 6d56ade8e4..8216538ceb 100644
--- a/.github/workflows/checkbox-promote-beta-to-candidate.yml
+++ b/.github/workflows/checkbox-promote-beta-to-candidate.yml
@@ -59,7 +59,7 @@ jobs:
             checkbox_track: uc22
     steps:
     - name: Checkout checkbox monorepo
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       with:
           persist-credentials: false
 
diff --git a/.github/workflows/checkbox-stable-release.yml b/.github/workflows/checkbox-stable-release.yml
index 73df40086d..97b2f1bf6d 100644
--- a/.github/workflows/checkbox-stable-release.yml
+++ b/.github/workflows/checkbox-stable-release.yml
@@ -24,7 +24,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout checkbox monorepo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -60,7 +60,7 @@ jobs:
           sudo apt update -qq
           sudo apt install -qq -y python3-launchpadlib
       - name: Checkout checkbox monorepo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
       - name: Copy deb packages from testing to stable ppa
diff --git a/.github/workflows/checkbox-tics.yml b/.github/workflows/checkbox-tics.yml
index 6f6e78c67f..eb8d6c85ea 100644
--- a/.github/workflows/checkbox-tics.yml
+++ b/.github/workflows/checkbox-tics.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     environment: TICS
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/daily-builds.yml b/.github/workflows/daily-builds.yml
index f2429a6637..4f59cc46ed 100644
--- a/.github/workflows/daily-builds.yml
+++ b/.github/workflows/daily-builds.yml
@@ -21,7 +21,7 @@ jobs:
     outputs:
       new_commit_count: ${{ steps.commit_check.outputs.new_commit_count }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/deb-daily-builds.yml b/.github/workflows/deb-daily-builds.yml
index 851a64d3d4..4407b4deda 100644
--- a/.github/workflows/deb-daily-builds.yml
+++ b/.github/workflows/deb-daily-builds.yml
@@ -25,7 +25,7 @@ jobs:
           sudo apt update -qq
           sudo apt install -qq -y python3-launchpadlib
       - name: Checkout checkbox monorepo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -70,7 +70,7 @@ jobs:
           sudo apt update -qq
           sudo apt install -qq -y python3-launchpadlib
       - name: Checkout checkbox monorepo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/deb-sanity-builds.yml b/.github/workflows/deb-sanity-builds.yml
index 4967dd9ea0..279712f177 100644
--- a/.github/workflows/deb-sanity-builds.yml
+++ b/.github/workflows/deb-sanity-builds.yml
@@ -17,7 +17,7 @@ jobs:
           sudo apt update -qq
           sudo apt install -qq -y python3-launchpadlib
       - name: Checkout checkbox monorepo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -47,7 +47,7 @@ jobs:
           sudo apt update -qq
           sudo apt install -qq -y python3-launchpadlib
       - name: Checkout checkbox monorepo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/deb_validator.yaml b/.github/workflows/deb_validator.yaml
index f122923224..31e739831a 100644
--- a/.github/workflows/deb_validator.yaml
+++ b/.github/workflows/deb_validator.yaml
@@ -38,7 +38,7 @@ jobs:
       paths: ${{ steps.paths.outputs.paths }}
     steps:
       - name: Checkout Checkbox monorepo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
           fetch-depth: 0
@@ -82,7 +82,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout Checkbox monorepo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
       # needed by providers that pull checkbox-support
diff --git a/.github/workflows/dispatch_lab_job.yaml b/.github/workflows/dispatch_lab_job.yaml
index 6206880c4c..978b89a1d1 100644
--- a/.github/workflows/dispatch_lab_job.yaml
+++ b/.github/workflows/dispatch_lab_job.yaml
@@ -55,7 +55,7 @@ jobs:
     steps:
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/documentation-check.yml b/.github/workflows/documentation-check.yml
index ce8bfdc648..7fd8303ab1 100644
--- a/.github/workflows/documentation-check.yml
+++ b/.github/workflows/documentation-check.yml
@@ -27,7 +27,7 @@ jobs:
         working-directory: docs
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
 
@@ -54,7 +54,7 @@ jobs:
         - X64
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
 
@@ -84,7 +84,7 @@ jobs:
         working-directory: docs
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
           fetch-depth: 0 # git history use by sphinx-sitemap during build for last-modified dates
diff --git a/.github/workflows/metabox.yaml b/.github/workflows/metabox.yaml
index 544009c4ca..81dfd60b3c 100644
--- a/.github/workflows/metabox.yaml
+++ b/.github/workflows/metabox.yaml
@@ -16,7 +16,7 @@ jobs:
     outputs:
       required_run: ${{ steps.check_diff.outputs.required_run }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -54,7 +54,7 @@ jobs:
       PYCHARM_HOSTED: True
     steps:
       - name: Checkout Checkbox monorepo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
       - name: Setup LXD
diff --git a/.github/workflows/pr_validation.yaml b/.github/workflows/pr_validation.yaml
index 6ae6bffa02..e0d5bc398d 100644
--- a/.github/workflows/pr_validation.yaml
+++ b/.github/workflows/pr_validation.yaml
@@ -32,7 +32,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Checkbox monorepo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -124,7 +124,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Checkbox monorepo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/sbom.yaml b/.github/workflows/sbom.yaml
index 3019246185..dae42b7d62 100644
--- a/.github/workflows/sbom.yaml
+++ b/.github/workflows/sbom.yaml
@@ -40,7 +40,7 @@ jobs:
             git-lfs
 
       - name: Checkout Repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           lfs: true
           persist-credentials: false
diff --git a/.github/workflows/snap-build-on-approval.yaml b/.github/workflows/snap-build-on-approval.yaml
index d354e8251b..d705634801 100644
--- a/.github/workflows/snap-build-on-approval.yaml
+++ b/.github/workflows/snap-build-on-approval.yaml
@@ -16,7 +16,7 @@ jobs:
     outputs:
       required_run: ${{ steps.check_diff.outputs.required_run }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/testflinger-contrib-dss-regression.yaml b/.github/workflows/testflinger-contrib-dss-regression.yaml
index e27c8a65c1..bead1230f9 100644
--- a/.github/workflows/testflinger-contrib-dss-regression.yaml
+++ b/.github/workflows/testflinger-contrib-dss-regression.yaml
@@ -80,7 +80,7 @@ jobs:
               com.canonical.contrib::has_intel_gpus = false
     steps:
       - name: Check out code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
diff --git a/.github/workflows/tox-checkbox.yaml b/.github/workflows/tox-checkbox.yaml
index 67da8e3882..8c9ce0db1a 100644
--- a/.github/workflows/tox-checkbox.yaml
+++ b/.github/workflows/tox-checkbox.yaml
@@ -38,7 +38,7 @@ jobs:
       path_flag: ${{ steps.paths.outputs.paths }}
     steps:
       - name: Checkout Checkbox monorepo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
           fetch-depth: 0
@@ -114,7 +114,7 @@ jobs:
         working-directory: ${{ matrix.path_flag.path }}
     runs-on: ${{ (matrix.python == '3.5' || matrix.python == '3.6') && fromJson('["self-hosted", "focal"]') || 'ubuntu-latest' }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
       # Python 3.5 setup was failing because of a CERTIFICATE_VERIFY_FAILED
diff --git a/.github/workflows/tox-contrib-pc-sanity.yaml b/.github/workflows/tox-contrib-pc-sanity.yaml
index 5de4f38857..8937a1d40d 100644
--- a/.github/workflows/tox-contrib-pc-sanity.yaml
+++ b/.github/workflows/tox-contrib-pc-sanity.yaml
@@ -30,7 +30,7 @@ jobs:
           - python: "3.10"
             tox_env_name: "py310"
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
       - name: Setup Python
diff --git a/.github/workflows/tox-contrib-provider-ce-oem.yaml b/.github/workflows/tox-contrib-provider-ce-oem.yaml
index 655fa2a656..701e562ab7 100644
--- a/.github/workflows/tox-contrib-provider-ce-oem.yaml
+++ b/.github/workflows/tox-contrib-provider-ce-oem.yaml
@@ -30,7 +30,7 @@ jobs:
             tox_env_name: "py310"
     runs-on: ${{ (matrix.python == '3.5' || matrix.python == '3.6') && fromJson('["self-hosted", "focal"]') || 'ubuntu-latest' }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
       # Python 3.5 setup was failing because of a CERTIFICATE_VERIFY_FAILED
diff --git a/.github/workflows/tox-contrib-provider-checkbox-gfx.yaml b/.github/workflows/tox-contrib-provider-checkbox-gfx.yaml
index 45262235be..29c4437cbe 100644
--- a/.github/workflows/tox-contrib-provider-checkbox-gfx.yaml
+++ b/.github/workflows/tox-contrib-provider-checkbox-gfx.yaml
@@ -28,7 +28,7 @@ jobs:
           - python: "3.10"
             tox_env_name: "py310"
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
       - name: Setup Python
diff --git a/.github/workflows/tox-contrib-provider-dss.yaml b/.github/workflows/tox-contrib-provider-dss.yaml
index c634ccfa9e..5ecae0df7a 100644
--- a/.github/workflows/tox-contrib-provider-dss.yaml
+++ b/.github/workflows/tox-contrib-provider-dss.yaml
@@ -28,7 +28,7 @@ jobs:
           - python: "3.10"
             tox_env_name: "py310"
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
       - name: Setup Python
diff --git a/.github/workflows/tox-provider-docker.yaml b/.github/workflows/tox-provider-docker.yaml
index f65c2ca65d..a2d0476570 100644
--- a/.github/workflows/tox-provider-docker.yaml
+++ b/.github/workflows/tox-provider-docker.yaml
@@ -34,7 +34,7 @@ jobs:
             tox_env_name: "py310"
     runs-on: ${{ (matrix.python == '3.5' || matrix.python == '3.6') && fromJson('["self-hosted", "focal"]') || 'ubuntu-latest' }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
       # Python 3.5 setup was failing because of a CERTIFICATE_VERIFY_FAILED
diff --git a/.github/workflows/tox-provider-tpm2.yaml b/.github/workflows/tox-provider-tpm2.yaml
index 406e67bf69..e764d93195 100644
--- a/.github/workflows/tox-provider-tpm2.yaml
+++ b/.github/workflows/tox-provider-tpm2.yaml
@@ -34,7 +34,7 @@ jobs:
             tox_env_name: "py310"
     runs-on: ${{ (matrix.python == '3.5' || matrix.python == '3.6') && fromJson('["self-hosted", "focal"]') || 'ubuntu-latest' }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
       # Python 3.5 setup was failing because of a CERTIFICATE_VERIFY_FAILED
diff --git a/.github/workflows/tox-provider-tutorial.yaml b/.github/workflows/tox-provider-tutorial.yaml
index 22f924321b..3940d1926f 100644
--- a/.github/workflows/tox-provider-tutorial.yaml
+++ b/.github/workflows/tox-provider-tutorial.yaml
@@ -34,7 +34,7 @@ jobs:
             tox_env_name: "py310"
     runs-on: ${{ (matrix.python == '3.5' || matrix.python == '3.6') && fromJson('["self-hosted", "focal"]') || 'ubuntu-latest' }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
       # Python 3.5 setup was failing because of a CERTIFICATE_VERIFY_FAILED
diff --git a/.github/workflows/tox-tools-release.yaml b/.github/workflows/tox-tools-release.yaml
index 473b5ab8b0..c897208bc2 100644
--- a/.github/workflows/tox-tools-release.yaml
+++ b/.github/workflows/tox-tools-release.yaml
@@ -22,7 +22,7 @@ jobs:
         working-directory: tools/release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
       - name: Setup Python
diff --git a/.github/workflows/unit_yaml_validator.yaml b/.github/workflows/unit_yaml_validator.yaml
index 8c1c640f0c..6eaa8134b3 100644
--- a/.github/workflows/unit_yaml_validator.yaml
+++ b/.github/workflows/unit_yaml_validator.yaml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Checkbox monorepo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
       - name: Install uv
diff --git a/.github/workflows/validate_workflows.yaml b/.github/workflows/validate_workflows.yaml
index e6251af95d..30163ec44c 100644
--- a/.github/workflows/validate_workflows.yaml
+++ b/.github/workflows/validate_workflows.yaml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Checkbox monorepo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
       - name: Install action-validator with asdf
@@ -29,7 +29,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Checkbox monorepo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
       - name: Install zizmor from crates.io
diff --git a/.github/workflows/verify-manifest.yaml b/.github/workflows/verify-manifest.yaml
index b9b739556c..4048d82f18 100644
--- a/.github/workflows/verify-manifest.yaml
+++ b/.github/workflows/verify-manifest.yaml
@@ -21,7 +21,7 @@ jobs:
       path: ${{ steps.paths.outputs.paths }}
     steps:
       - name: Checkout Checkbox monorepo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
           fetch-depth: 0
@@ -70,7 +70,7 @@ jobs:
         working-directory: ${{ matrix.path }}
     runs-on: 'ubuntu-latest'
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
       - name: Install dependencies