diff --git a/.github/workflows/cli.yaml b/.github/workflows/cli.yaml
index 2f6413a7..738d88e9 100644
--- a/.github/workflows/cli.yaml
+++ b/.github/workflows/cli.yaml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
       - name: Build
         run: cargo build --release --verbose
         working-directory: ./cli
diff --git a/.github/workflows/pgTAP.yaml b/.github/workflows/pgTAP.yaml
index 43bd94d5..0d8cd79c 100644
--- a/.github/workflows/pgTAP.yaml
+++ b/.github/workflows/pgTAP.yaml
@@ -10,7 +10,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
       - uses: supabase/setup-cli@v1
         with:
           version: 2.75.0
diff --git a/.github/workflows/pre-commit_hooks.yaml b/.github/workflows/pre-commit_hooks.yaml
index af1c174c..18f7830b 100644
--- a/.github/workflows/pre-commit_hooks.yaml
+++ b/.github/workflows/pre-commit_hooks.yaml
@@ -11,7 +11,7 @@ jobs:
 
     steps:
     - name: checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@v6.0.2
 
     - name: set up python 3.10
       uses: actions/setup-python@v6
diff --git a/.github/workflows/prettier.yaml b/.github/workflows/prettier.yaml
index 211a9c9e..08c1eaa1 100644
--- a/.github/workflows/prettier.yaml
+++ b/.github/workflows/prettier.yaml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.2
       - name: Run Prettier
         uses: creyD/prettier_action@v4.6
         with:
diff --git a/.github/workflows/release-cli.yaml b/.github/workflows/release-cli.yaml
index 7ef4756f..4da5613e 100644
--- a/.github/workflows/release-cli.yaml
+++ b/.github/workflows/release-cli.yaml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.2
       - name: Read CLI version
         uses: SebRollen/toml-action@v1.2.0
         id: read_cli_version
@@ -65,7 +65,7 @@ jobs:
           profile: minimal
           toolchain: stable
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
       - name: Build and Package
         run: |
           cd cli
@@ -131,7 +131,7 @@ jobs:
           profile: minimal
           toolchain: stable
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
       - name: Build and Package
         run: |
           cd cli
@@ -162,7 +162,7 @@ jobs:
           profile: minimal
           toolchain: stable
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
       - name: Build and Package
         run: |
           cd cli
diff --git a/.github/workflows/release-homebrew-tap.yaml b/.github/workflows/release-homebrew-tap.yaml
index ce4aaa23..1f66388e 100644
--- a/.github/workflows/release-homebrew-tap.yaml
+++ b/.github/workflows/release-homebrew-tap.yaml
@@ -17,7 +17,7 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           repository: supabase/homebrew-tap
           ref: "main"
diff --git a/.github/workflows/release-scoop-bucket.yaml b/.github/workflows/release-scoop-bucket.yaml
index 4df45965..7533fb09 100644
--- a/.github/workflows/release-scoop-bucket.yaml
+++ b/.github/workflows/release-scoop-bucket.yaml
@@ -17,7 +17,7 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           repository: supabase/scoop-bucket
           ref: "main"
diff --git a/.github/workflows/update-supabase-js.yml b/.github/workflows/update-supabase-js.yml
index 323c9b2b..b4f88181 100644
--- a/.github/workflows/update-supabase-js.yml
+++ b/.github/workflows/update-supabase-js.yml
@@ -25,7 +25,7 @@ jobs:
       cancel-in-progress: false
 
     steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ github.event.repository.default_branch }}
 
diff --git a/.github/workflows/website-tests.yaml b/.github/workflows/website-tests.yaml
index e5a9b94e..e77bef20 100644
--- a/.github/workflows/website-tests.yaml
+++ b/.github/workflows/website-tests.yaml
@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.2
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v4