diff --git a/.github/workflows/ci-checks.yml b/.github/workflows/ci-checks.yml
index ddf2a7dc..6d493b34 100644
--- a/.github/workflows/ci-checks.yml
+++ b/.github/workflows/ci-checks.yml
@@ -31,7 +31,7 @@ jobs:
     name: typecheck
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up Bun
         uses: oven-sh/setup-bun@v2
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ba0b0823..789eaeeb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,7 +22,7 @@ jobs:
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v6
       - uses: DeterminateSystems/determinate-nix-action@v3.20.0
         with: &nix-install-with
           extra-conf: |
@@ -46,7 +46,7 @@ jobs:
       matrix: ${{ fromJson(needs.configure.outputs.matrix) }}
       fail-fast: false
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v6
       - name: Install Nix
         uses: DeterminateSystems/determinate-nix-action@v3.20.0
         with: *nix-install-with
diff --git a/.github/workflows/deploy-api.yaml b/.github/workflows/deploy-api.yaml
index 2c29268b..3a14f125 100644
--- a/.github/workflows/deploy-api.yaml
+++ b/.github/workflows/deploy-api.yaml
@@ -55,7 +55,7 @@ jobs:
       # the derivation hash matches across steps.
       STACKPANEL_ROOT_ABSOLUTE: ${{ github.workspace }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: DeterminateSystems/nix-installer-action@main
         with:
diff --git a/.github/workflows/deploy-docs.yaml b/.github/workflows/deploy-docs.yaml
index 3c490689..731c5a77 100644
--- a/.github/workflows/deploy-docs.yaml
+++ b/.github/workflows/deploy-docs.yaml
@@ -70,7 +70,7 @@ jobs:
       name: docs-${{ needs.stage.outputs.stage }}
       url: ${{ steps.deploy.outputs.url }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: oven-sh/setup-bun@v2
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -114,7 +114,7 @@ jobs:
       contents: read
       pull-requests: write    # sticky comment
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: oven-sh/setup-bun@v2
       - name: Install dependencies
         run: bun install --frozen-lockfile
diff --git a/.github/workflows/deploy-nixos.yml b/.github/workflows/deploy-nixos.yml
index 4dbf1365..416996d5 100644
--- a/.github/workflows/deploy-nixos.yml
+++ b/.github/workflows/deploy-nixos.yml
@@ -29,7 +29,7 @@ jobs:
     outputs:
       store-path: ${{ steps.build.outputs.store-path }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
@@ -66,7 +66,7 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
diff --git a/.github/workflows/deploy-web.yaml b/.github/workflows/deploy-web.yaml
index cccb14f5..a2369d8a 100644
--- a/.github/workflows/deploy-web.yaml
+++ b/.github/workflows/deploy-web.yaml
@@ -72,7 +72,7 @@ jobs:
       name: ${{ needs.stage.outputs.stage }}
       url: ${{ steps.deploy.outputs.url }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: oven-sh/setup-bun@v2
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -144,7 +144,7 @@ jobs:
       contents: read
       pull-requests: write    # sticky comment
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: oven-sh/setup-bun@v2
       - name: Install dependencies
         run: bun install --frozen-lockfile
diff --git a/.github/workflows/devenv-cache.yml b/.github/workflows/devenv-cache.yml
index def86131..7ea591a7 100644
--- a/.github/workflows/devenv-cache.yml
+++ b/.github/workflows/devenv-cache.yml
@@ -35,7 +35,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install Nix
         uses: cachix/install-nix-action@v31
diff --git a/.github/workflows/secrets-codegen-check.yml b/.github/workflows/secrets-codegen-check.yml
index 4b0bd332..4d4fa352 100644
--- a/.github/workflows/secrets-codegen-check.yml
+++ b/.github/workflows/secrets-codegen-check.yml
@@ -52,7 +52,7 @@ jobs:
   verify:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
diff --git a/.github/workflows/test-fixtures.yml b/.github/workflows/test-fixtures.yml
index d9c3f019..3535eaf6 100644
--- a/.github/workflows/test-fixtures.yml
+++ b/.github/workflows/test-fixtures.yml
@@ -26,7 +26,7 @@ jobs:
     outputs:
       fixtures: ${{ steps.list.outputs.fixtures }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: List fixtures
         id: list
         run: |
@@ -48,7 +48,7 @@ jobs:
           - aarch64-darwin
       fail-fast: false
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main