diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 5149ca904e1..3fca2a82310 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -55,7 +55,7 @@ jobs:
     steps:
       # https://github.com/actions/checkout
       - name: Checkout codebase
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.2
 
       # https://github.com/actions/setup-node
       - name: Install Node.js ${{ matrix.node-version }}
@@ -328,7 +328,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.2
 
       # Download artifacts from previous 'tests' job
       - name: Download coverage artifacts
diff --git a/.github/workflows/codescan.yml b/.github/workflows/codescan.yml
index 6d9ceff3703..256e0477ddd 100644
--- a/.github/workflows/codescan.yml
+++ b/.github/workflows/codescan.yml
@@ -35,7 +35,7 @@ jobs:
     steps:
       # https://github.com/actions/checkout
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.2
 
       # Initializes the CodeQL tools for scanning.
       # https://github.com/github/codeql-action
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 81b9266eb4d..8772217db90 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -79,7 +79,7 @@ jobs:
     steps:
       # Checkout our codebase (to get access to Docker Compose scripts)
       - name: Checkout codebase
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.2
       # Download Docker image artifacts (which were just built by reusable-docker-build.yml)
       - name: Download Docker image artifacts
         uses: actions/download-artifact@v8
diff --git a/.github/workflows/port_merged_pull_request.yml b/.github/workflows/port_merged_pull_request.yml
index 676ad45ba26..30919bc37d5 100644
--- a/.github/workflows/port_merged_pull_request.yml
+++ b/.github/workflows/port_merged_pull_request.yml
@@ -23,7 +23,7 @@ jobs:
     if: github.event.pull_request.merged
     steps:
       # Checkout code
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
       # Port PR to other branch (ONLY if labeled with "port to")
       # See https://github.com/korthout/backport-action
       - name: Create backport pull requests