diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a775cd6..ff5397d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -23,7 +23,7 @@ jobs:
     steps:
       # ── 1. Checkout ───────────────────────────────────────────────────────
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       # ── 2. Set up Go ──────────────────────────────────────────────────────
       - name: Set up Go
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8e602ae..2905aa5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -23,7 +23,7 @@ jobs:
     steps:
       # Full history is required by GoReleaser to build the changelog.
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0