diff --git a/.github/workflows/_build.yml b/.github/workflows/_build.yml
index 98891bb..e1e589b 100644
--- a/.github/workflows/_build.yml
+++ b/.github/workflows/_build.yml
@@ -20,7 +20,7 @@ jobs:
         with:
           egress-policy: audit
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - name: Setup workspace
diff --git a/.github/workflows/_dependency-review.yml b/.github/workflows/_dependency-review.yml
index c6dea1f..ccd6d85 100644
--- a/.github/workflows/_dependency-review.yml
+++ b/.github/workflows/_dependency-review.yml
@@ -23,7 +23,7 @@ jobs:
         with:
           egress-policy: audit
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - name: Review dependency changes
diff --git a/.github/workflows/_link-check.yml b/.github/workflows/_link-check.yml
index 8bda71f..56d3811 100644
--- a/.github/workflows/_link-check.yml
+++ b/.github/workflows/_link-check.yml
@@ -20,7 +20,7 @@ jobs:
         with:
           egress-policy: audit
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - name: Link check
diff --git a/.github/workflows/_package.yml b/.github/workflows/_package.yml
index 46dda6d..696c990 100644
--- a/.github/workflows/_package.yml
+++ b/.github/workflows/_package.yml
@@ -20,7 +20,7 @@ jobs:
         with:
           egress-policy: audit
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - name: Setup workspace
diff --git a/.github/workflows/_publish-marketplace.yml b/.github/workflows/_publish-marketplace.yml
index 8a562eb..cf2516c 100644
--- a/.github/workflows/_publish-marketplace.yml
+++ b/.github/workflows/_publish-marketplace.yml
@@ -43,7 +43,7 @@ jobs:
           fi
       - name: Checkout
         if: steps.guard.outputs.skip != 'true'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - name: Setup workspace
diff --git a/.github/workflows/_publish-openvsx.yml b/.github/workflows/_publish-openvsx.yml
index c07e7a2..91fb267 100644
--- a/.github/workflows/_publish-openvsx.yml
+++ b/.github/workflows/_publish-openvsx.yml
@@ -43,7 +43,7 @@ jobs:
         id: guard
       - name: Checkout
         if: steps.guard.outputs.skip != 'true'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - name: Setup workspace
diff --git a/.github/workflows/_spell-check.yml b/.github/workflows/_spell-check.yml
index 01bb6e5..10ccc77 100644
--- a/.github/workflows/_spell-check.yml
+++ b/.github/workflows/_spell-check.yml
@@ -20,7 +20,7 @@ jobs:
         with:
           egress-policy: audit
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - name: typos
diff --git a/.github/workflows/_static-checks.yml b/.github/workflows/_static-checks.yml
index d37ae9f..79a128a 100644
--- a/.github/workflows/_static-checks.yml
+++ b/.github/workflows/_static-checks.yml
@@ -26,7 +26,7 @@ jobs:
         with:
           egress-policy: audit
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - name: Setup workspace
diff --git a/.github/workflows/_test.yml b/.github/workflows/_test.yml
index f5eaefa..a6b106a 100644
--- a/.github/workflows/_test.yml
+++ b/.github/workflows/_test.yml
@@ -24,7 +24,7 @@ jobs:
         with:
           egress-policy: audit
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - name: Setup workspace
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 23ec29e..4dd92e4 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -34,7 +34,7 @@ jobs:
         with:
           egress-policy: audit
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - name: Initialize CodeQL
diff --git a/.github/workflows/docs-deploy.yml b/.github/workflows/docs-deploy.yml
index aa7a3df..2abfa5c 100644
--- a/.github/workflows/docs-deploy.yml
+++ b/.github/workflows/docs-deploy.yml
@@ -35,7 +35,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Setup workspace
         uses: ./.github/actions/setup
diff --git a/.github/workflows/fuzzing.yml b/.github/workflows/fuzzing.yml
index ec567ab..853eb2a 100644
--- a/.github/workflows/fuzzing.yml
+++ b/.github/workflows/fuzzing.yml
@@ -38,7 +38,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/label-sync.yml b/.github/workflows/label-sync.yml
index 3dc9e31..1555f20 100644
--- a/.github/workflows/label-sync.yml
+++ b/.github/workflows/label-sync.yml
@@ -23,7 +23,7 @@ jobs:
         with:
           egress-policy: audit
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - name: Sync labels
diff --git a/.github/workflows/pre-release.yml b/.github/workflows/pre-release.yml
index da81934..ad999da 100644
--- a/.github/workflows/pre-release.yml
+++ b/.github/workflows/pre-release.yml
@@ -60,7 +60,7 @@ jobs:
         with:
           egress-policy: audit
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - name: Setup workspace
@@ -93,7 +93,7 @@ jobs:
         with:
           egress-policy: audit
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - name: Download all .vsix artifacts
diff --git a/.github/workflows/release-please-prettier.yml b/.github/workflows/release-please-prettier.yml
index f635d74..15af1c9 100644
--- a/.github/workflows/release-please-prettier.yml
+++ b/.github/workflows/release-please-prettier.yml
@@ -50,7 +50,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout PR branch
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ github.head_ref }}
           # persist-credentials must stay true so the later `git push` can
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3263cea..1dd59da 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -103,7 +103,7 @@ jobs:
         with:
           egress-policy: audit
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - name: Setup workspace
diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml
index ee5cea2..6e8080b 100644
--- a/.github/workflows/sbom.yml
+++ b/.github/workflows/sbom.yml
@@ -29,7 +29,7 @@ jobs:
         with:
           egress-policy: audit
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - name: Setup workspace
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index acc7ad4..a5e66fa 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -27,7 +27,7 @@ jobs:
         with:
           egress-policy: audit
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - name: Run Scorecard