diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 675a72824..5836e3ebb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,7 +12,7 @@ jobs:
       group: ${{ github.workflow }}-${{ github.ref }}
       cancel-in-progress: true
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - uses: ./
 
       # Make sure the latest changes from the pull request are used.
@@ -117,7 +117,7 @@ jobs:
             runner: ubuntu-24.04
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - uses: ./
         with:
           # Bootstrapping a postmarketOS tools tree on the Ubuntu host needs apk; all other
diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml
index be2b1259c..f951453e8 100644
--- a/.github/workflows/claude-review.yml
+++ b/.github/workflows/claude-review.yml
@@ -146,7 +146,7 @@ jobs:
       id-token: write       # Authenticate with AWS via OIDC
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           # Need full history for git worktree add to work on all PR commits.
           fetch-depth: 0