diff --git a/.github/workflows/post-merge.yml b/.github/workflows/post-merge.yml
index 6631c00f..055ef025 100644
--- a/.github/workflows/post-merge.yml
+++ b/.github/workflows/post-merge.yml
@@ -56,7 +56,7 @@ jobs:
       merge_sha: ${{ github.sha }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
           # Issue #669: submodule installs symlink .claude/scripts/* into the
@@ -99,7 +99,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
           # Issue #669: submodule installs symlink .claude/scripts/* into the
@@ -179,7 +179,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout code
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
           # Issue #669: submodule installs symlink .claude/scripts/* into the
diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml
index 9d87570e..51a36f17 100644
--- a/.github/workflows/pr-ci.yml
+++ b/.github/workflows/pr-ci.yml
@@ -49,7 +49,7 @@ jobs:
         # Pinned to the same SHA the post-merge workflow uses (v4.3.1).
         # See post-merge.yml header for the submodule-recursion rationale —
         # this repo has no submodules today so `submodules: false` is fine.
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           submodules: false