diff --git a/.github/workflows/base.yml b/.github/workflows/base.yml
index deba0560..91e1680e 100644
--- a/.github/workflows/base.yml
+++ b/.github/workflows/base.yml
@@ -35,7 +35,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
 
@@ -112,7 +112,7 @@ jobs:
     if: needs.build-base.result == 'success'
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
 
@@ -156,7 +156,7 @@ jobs:
       changed: ${{ steps.changes.outputs.autoresearch_any_changed }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
 
@@ -261,7 +261,7 @@ jobs:
           || needs.build-autoresearch.outputs.changed == 'true')
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
 
@@ -313,7 +313,7 @@ jobs:
         cuda: [cu1281, cu1290, cu1300]
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
 
@@ -422,7 +422,7 @@ jobs:
         cuda: [cu1281, cu1290, cu1300]
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
 
@@ -477,7 +477,7 @@ jobs:
         cuda: [cu1281, cu1290, cu1300]
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
 
@@ -591,7 +591,7 @@ jobs:
         cuda: [cu1281, cu1290, cu1300]
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/compute-version.yml b/.github/workflows/compute-version.yml
index f9acb18c..c3cc77bb 100644
--- a/.github/workflows/compute-version.yml
+++ b/.github/workflows/compute-version.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: detect-bump unit tests
         run: bash .github/actions/compute-version/test_detect-bump.sh
diff --git a/.github/workflows/hadolint-pr.yml b/.github/workflows/hadolint-pr.yml
index 0a844d39..8310bc74 100644
--- a/.github/workflows/hadolint-pr.yml
+++ b/.github/workflows/hadolint-pr.yml
@@ -26,7 +26,7 @@ jobs:
             ignore: "DL3008"
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       # TTY + default stdout so hadolint-action's problem matcher surfaces
       # annotations on the PR "Files changed" tab (SARIF/Code Scanning is much harder to spot).
diff --git a/.github/workflows/hadolint-push.yml b/.github/workflows/hadolint-push.yml
index d92e97db..1a8c2634 100644
--- a/.github/workflows/hadolint-push.yml
+++ b/.github/workflows/hadolint-push.yml
@@ -29,7 +29,7 @@ jobs:
             ignore: "DL3008"
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: Lint Dockerfile
         uses: ./.github/actions/hadolint
diff --git a/.github/workflows/manual-release.yml b/.github/workflows/manual-release.yml
index 60999a6d..7bfb428c 100644
--- a/.github/workflows/manual-release.yml
+++ b/.github/workflows/manual-release.yml
@@ -127,7 +127,7 @@ jobs:
           echo "Will tag at ${HEAD_SHA}"
 
       - name: Checkout source commit
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           fetch-tags: true
diff --git a/.github/workflows/nvidia.yml b/.github/workflows/nvidia.yml
index 8a5e8590..01e59092 100644
--- a/.github/workflows/nvidia.yml
+++ b/.github/workflows/nvidia.yml
@@ -31,7 +31,7 @@ jobs:
         nvidia: [pytorch2511]
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
 
@@ -118,7 +118,7 @@ jobs:
         nvidia: [pytorch2511]
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 228bacc6..dbccfd32 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -46,7 +46,7 @@ jobs:
       bump: ${{ steps.v.outputs.bump }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           fetch-tags: true
@@ -68,7 +68,7 @@ jobs:
       rocm: ${{ steps.f.outputs.rocm_any_changed }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
 
@@ -148,7 +148,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           fetch-tags: true
diff --git a/.github/workflows/rocm.yml b/.github/workflows/rocm.yml
index 9d84caed..dc16c0af 100644
--- a/.github/workflows/rocm.yml
+++ b/.github/workflows/rocm.yml
@@ -31,7 +31,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
       
@@ -113,7 +113,7 @@ jobs:
         rocm: [rocm644]
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
index c5c88dd0..eb8f9ccb 100644
--- a/.github/workflows/shellcheck.yml
+++ b/.github/workflows/shellcheck.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: Shellcheck
         uses: reviewdog/action-shellcheck@4c07458293ac342d477251099501a718ae5ef86e
diff --git a/.github/workflows/sonarqube.yml b/.github/workflows/sonarqube.yml
index a4d5a3e2..5a77071c 100644
--- a/.github/workflows/sonarqube.yml
+++ b/.github/workflows/sonarqube.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: SonarQube Scan
         uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e