diff --git a/.github/workflows/ci-checks.yml b/.github/workflows/ci-checks.yml
index ddf2a7dc..6d493b34 100644
--- a/.github/workflows/ci-checks.yml
+++ b/.github/workflows/ci-checks.yml
@@ -31,7 +31,7 @@ jobs:
     name: typecheck
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up Bun
         uses: oven-sh/setup-bun@v2
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cd7bdb50..bdbbcdd6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,7 +22,7 @@ jobs:
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v6
       - uses: DeterminateSystems/determinate-nix-action@v3.20.0
         with: &nix-install-with
           extra-conf: |
@@ -46,7 +46,7 @@ jobs:
       matrix: ${{ fromJson(needs.configure.outputs.matrix) }}
       fail-fast: false
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v6
       - name: Install Nix
         uses: DeterminateSystems/determinate-nix-action@v3.20.0
         with: *nix-install-with
diff --git a/.github/workflows/deploy-api.yaml b/.github/workflows/deploy-api.yaml
index 2c29268b..3a14f125 100644
--- a/.github/workflows/deploy-api.yaml
+++ b/.github/workflows/deploy-api.yaml
@@ -55,7 +55,7 @@ jobs:
       # the derivation hash matches across steps.
       STACKPANEL_ROOT_ABSOLUTE: ${{ github.workspace }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: DeterminateSystems/nix-installer-action@main
         with:
diff --git a/.github/workflows/deploy-docs.yaml b/.github/workflows/deploy-docs.yaml
index 15309f80..999220b0 100644
--- a/.github/workflows/deploy-docs.yaml
+++ b/.github/workflows/deploy-docs.yaml
@@ -70,7 +70,7 @@ jobs:
       name: docs-${{ needs.stage.outputs.stage }}
       url: ${{ steps.deploy.outputs.url }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: oven-sh/setup-bun@v2
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -127,7 +127,7 @@ jobs:
       contents: read
       pull-requests: write # sticky comment
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: oven-sh/setup-bun@v2
       - name: Install dependencies
         run: bun install --frozen-lockfile
diff --git a/.github/workflows/deploy-nixos.yml b/.github/workflows/deploy-nixos.yml
index c9a35438..5ffc0eb6 100644
--- a/.github/workflows/deploy-nixos.yml
+++ b/.github/workflows/deploy-nixos.yml
@@ -29,7 +29,7 @@ jobs:
     outputs:
       store-path: ${{ steps.build.outputs.store-path }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
@@ -64,7 +64,7 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
diff --git a/.github/workflows/deploy-web.yaml b/.github/workflows/deploy-web.yaml
index 1568c391..c0b630c5 100644
--- a/.github/workflows/deploy-web.yaml
+++ b/.github/workflows/deploy-web.yaml
@@ -72,7 +72,7 @@ jobs:
       name: ${{ needs.stage.outputs.stage }}
       url: ${{ steps.deploy.outputs.url }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: oven-sh/setup-bun@v2
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -157,7 +157,7 @@ jobs:
       contents: read
       pull-requests: write # sticky comment
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: oven-sh/setup-bun@v2
       - name: Install dependencies
         run: bun install --frozen-lockfile
diff --git a/.github/workflows/secrets-codegen-check.yml b/.github/workflows/secrets-codegen-check.yml
index 95661581..b981a8dc 100644
--- a/.github/workflows/secrets-codegen-check.yml
+++ b/.github/workflows/secrets-codegen-check.yml
@@ -52,7 +52,7 @@ jobs:
   verify:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
diff --git a/.github/workflows/test-fixtures.yml b/.github/workflows/test-fixtures.yml
index f2631957..3e09daa3 100644
--- a/.github/workflows/test-fixtures.yml
+++ b/.github/workflows/test-fixtures.yml
@@ -26,7 +26,7 @@ jobs:
     outputs:
       fixtures: ${{ steps.list.outputs.fixtures }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: List fixtures
         id: list
         run: |
@@ -48,7 +48,7 @@ jobs:
           - aarch64-darwin
       fail-fast: false
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main