diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index be31af5..5c654d2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,7 +20,7 @@ jobs:
       run:
         working-directory: extension
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v6.0.3
         with:
           persist-credentials: false
       - uses: oven-sh/setup-bun@v2
@@ -90,7 +90,7 @@ jobs:
       run:
         working-directory: demo-site
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v6.0.3
         with:
           persist-credentials: false
       - uses: oven-sh/setup-bun@v2
@@ -119,7 +119,7 @@ jobs:
       run:
         working-directory: docs
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v6.0.3
         with:
           persist-credentials: false
       - uses: oven-sh/setup-bun@v2
@@ -147,7 +147,7 @@ jobs:
     name: Pre-commit hooks
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v6.0.3
         with:
           persist-credentials: false
       - uses: actions/setup-python@v6
@@ -168,7 +168,7 @@ jobs:
     name: Python (ruff + bandit + pyright + pytest)
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v6.0.3
         with:
           persist-credentials: false
           # Full history so the strict-on-new-files ratchet below can compute
diff --git a/.github/workflows/docs-deploy.yml b/.github/workflows/docs-deploy.yml
index 3d3e1e1..66f9559 100644
--- a/.github/workflows/docs-deploy.yml
+++ b/.github/workflows/docs-deploy.yml
@@ -23,7 +23,7 @@ jobs:
       run:
         working-directory: docs
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v6.0.3
         with:
           persist-credentials: false
       - uses: oven-sh/setup-bun@v2
diff --git a/.github/workflows/manifest-permission-diff.yml b/.github/workflows/manifest-permission-diff.yml
index e9ec259..5cc62c1 100644
--- a/.github/workflows/manifest-permission-diff.yml
+++ b/.github/workflows/manifest-permission-diff.yml
@@ -18,7 +18,7 @@ jobs:
     name: Diff MV3 permissions vs base
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v6.0.3
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/release-extension.yml b/.github/workflows/release-extension.yml
index 6ba694a..49fba4e 100644
--- a/.github/workflows/release-extension.yml
+++ b/.github/workflows/release-extension.yml
@@ -20,7 +20,7 @@ jobs:
     name: Build and publish extension release
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v6.0.3
         with:
           persist-credentials: false
       - uses: oven-sh/setup-bun@v2
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 7d76613..5746822 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -25,7 +25,7 @@ jobs:
     name: Audit workflows
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v6.0.3
         with:
           persist-credentials: false
       - uses: astral-sh/setup-uv@v8.2.0