diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 30fc5af..280f0ee 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,7 +10,7 @@ jobs:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v4
 
       - uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a  # v4
         with:
@@ -37,7 +37,7 @@ jobs:
       matrix:
         python-version: ["3.11", "3.12", "3.13", "3.14"]
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v4
         with:
           submodules: recursive
 
@@ -59,7 +59,7 @@ jobs:
     name: Build embedded (CI check)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v4
         with:
           submodules: recursive
 
@@ -132,7 +132,7 @@ jobs:
       # the demo container sets the same value.
       SETUPTOOLS_SCM_PRETEND_VERSION: "999.0.0"
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v4
         with:
           submodules: recursive
 
@@ -170,7 +170,7 @@ jobs:
           - 7080:7080
           - 7084:7084
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v4
         with:
           submodules: recursive
 
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 66776f1..a56115d 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -37,7 +37,7 @@ jobs:
       # runs on the new commit.
       - name: Check out the release branch
         if: steps.rp.outputs.pr
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v4
         with:
           ref: ${{ fromJSON(steps.rp.outputs.pr).headBranchName }}
           token: ${{ steps.app-token.outputs.token }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ce63558..e15c142 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -31,7 +31,7 @@ jobs:
           - name: llama-index-graph-stores-coordinode
             path: llama-index-coordinode
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v4
         with:
           submodules: recursive
           fetch-depth: 0   # hatch-vcs needs full history for tag detection
@@ -107,7 +107,7 @@ jobs:
 
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v4
         with:
           submodules: recursive
           fetch-depth: 0