diff --git a/.github/workflows/python-package.yml b/.github/workflows/python-package.yml
index ab36e812..70904cb0 100644
--- a/.github/workflows/python-package.yml
+++ b/.github/workflows/python-package.yml
@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           persist-credentials: false
       - name: Install Ruff
@@ -39,7 +39,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           persist-credentials: false
       - name: Checkout submodules
@@ -58,7 +58,7 @@ jobs:
           install-linux-dependencies: true
           build-type: "Debug"
           version: ${{ env.sdl-version }}
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           persist-credentials: false
           fetch-depth: ${{ env.git-depth }}
@@ -86,7 +86,7 @@ jobs:
         sdl-version: ["3.2.16"]
       fail-fast: true
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           persist-credentials: false
           fetch-depth: ${{ env.git-depth }}
@@ -127,7 +127,7 @@ jobs:
       fail-fast: false
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           persist-credentials: false
           fetch-depth: ${{ env.git-depth }}
@@ -187,7 +187,7 @@ jobs:
           install-linux-dependencies: true
           build-type: "Debug"
           version: ${{ env.sdl-version }}
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           persist-credentials: false
           fetch-depth: ${{ env.git-depth }}
@@ -213,7 +213,7 @@ jobs:
       matrix:
         os: ["ubuntu-latest"] # "windows-latest" disabled due to free-threaded build issues
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           persist-credentials: false
           fetch-depth: ${{ env.git-depth }}
@@ -247,7 +247,7 @@ jobs:
     env:
       BUILD_DESC: ""
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           persist-credentials: false
           fetch-depth: ${{ env.git-depth }}
@@ -305,7 +305,7 @@ jobs:
     env:
       PYTHON_DESC: ""
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           persist-credentials: false
           fetch-depth: ${{ env.git-depth }}
@@ -348,7 +348,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           persist-credentials: false
           fetch-depth: ${{ env.git-depth }}
diff --git a/.github/workflows/release-on-tag.yml b/.github/workflows/release-on-tag.yml
index b12ade30..52906929 100644
--- a/.github/workflows/release-on-tag.yml
+++ b/.github/workflows/release-on-tag.yml
@@ -17,7 +17,7 @@ jobs:
     permissions:
       contents: write # Publish GitHub Releases
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           persist-credentials: false
       - name: Generate body