diff --git a/.github/workflows/autofix.yml b/.github/workflows/autofix.yml
index 3aec3c940fd..2829a1b88f7 100644
--- a/.github/workflows/autofix.yml
+++ b/.github/workflows/autofix.yml
@@ -12,7 +12,7 @@ jobs:
     name: Autoupdate changelog entry and headers
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           persist-credentials: false
       - uses: actions/setup-python@v6
diff --git a/.github/workflows/autopush.yml b/.github/workflows/autopush.yml
index b2d86011a6f..125e6518fd3 100644
--- a/.github/workflows/autopush.yml
+++ b/.github/workflows/autopush.yml
@@ -11,7 +11,7 @@ jobs:
       contents: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           persist-credentials: true
           token: ${{ secrets.MNE_BOT_TOKEN }}
diff --git a/.github/workflows/check_changelog.yml b/.github/workflows/check_changelog.yml
index 5b0b5da07ba..093ede9d956 100644
--- a/.github/workflows/check_changelog.yml
+++ b/.github/workflows/check_changelog.yml
@@ -13,7 +13,7 @@ jobs:
     name: Check towncrier entry in doc/changes/dev/
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           persist-credentials: false
       - uses: scientific-python/action-towncrier-changelog@v2
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 29698a9eade..2c7499d06fc 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -38,7 +38,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@v6.0.2
       with:
         persist-credentials: false
 
diff --git a/.github/workflows/credit.yml b/.github/workflows/credit.yml
index 7814df4d76c..329d3bd94d0 100644
--- a/.github/workflows/credit.yml
+++ b/.github/workflows/credit.yml
@@ -17,7 +17,7 @@ jobs:
       GH_TOKEN: ${{ secrets.MNE_BOT_TOKEN }}
       GITHUB_TOKEN: ${{ secrets.MNE_BOT_TOKEN }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           persist-credentials: true
       - uses: actions/setup-python@v6
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 845c66fb43c..69d2bc315cb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,7 +16,7 @@ jobs:
   package:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           persist-credentials: false
       - uses: actions/setup-python@v6
diff --git a/.github/workflows/spec_zero.yml b/.github/workflows/spec_zero.yml
index 487267bc955..239dcaffd22 100644
--- a/.github/workflows/spec_zero.yml
+++ b/.github/workflows/spec_zero.yml
@@ -25,7 +25,7 @@ jobs:
       run:
         shell: bash -el {0}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           persist-credentials: true
       - name: Triage SSH
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 5d091115062..315983386b7 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 3
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           persist-credentials: false
       - uses: actions/setup-python@v6
@@ -89,7 +89,7 @@ jobs:
             python: '3.10'
             kind: old
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           fetch-depth: 0
           persist-credentials: false