diff --git a/.github/workflows/action.yml b/.github/workflows/action.yml
index ad02b752..dd36a8eb 100644
--- a/.github/workflows/action.yml
+++ b/.github/workflows/action.yml
@@ -14,12 +14,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: linkerd/dev/actions/setup-tools@v41
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - run: just-dev check-action-images
 
   dev-images:
     runs-on: ubuntu-latest
     steps:
       - uses: linkerd/dev/actions/setup-tools@v41
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - run: just-dev check-action-images
diff --git a/.github/workflows/codecov.yml b/.github/workflows/codecov.yml
index 6a620a19..36dd55e5 100644
--- a/.github/workflows/codecov.yml
+++ b/.github/workflows/codecov.yml
@@ -16,7 +16,7 @@ jobs:
       image: ghcr.io/linkerd/dev:v41-rust
       options: --security-opt seccomp=unconfined
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - run: cargo-tarpaulin tarpaulin --workspace --out Xml
       - uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d
         with:
diff --git a/.github/workflows/deny.yml b/.github/workflows/deny.yml
index 06b98928..74cac2e0 100644
--- a/.github/workflows/deny.yml
+++ b/.github/workflows/deny.yml
@@ -28,7 +28,7 @@ jobs:
     # Prevent sudden announcement of a new advisory from failing Ci.
     continue-on-error: ${{ matrix.checks == 'advisories' }}
     steps:
-    - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
     - uses: EmbarkStudios/cargo-deny-action@1e59595bed8fc55c969333d08d7817b36888f0c5
       with:
         command: check ${{ matrix.checks }}
diff --git a/.github/workflows/helm.yml b/.github/workflows/helm.yml
index a1769718..1405c409 100644
--- a/.github/workflows/helm.yml
+++ b/.github/workflows/helm.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: linkerd/dev/actions/setup-tools@v41
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - run: helm-docs
       - run: git diff --exit-code
 
@@ -24,5 +24,5 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: linkerd/dev/actions/setup-tools@v41
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - run: helm lint charts/*
diff --git a/.github/workflows/integration-test.yml b/.github/workflows/integration-test.yml
index d3895732..fea79d30 100644
--- a/.github/workflows/integration-test.yml
+++ b/.github/workflows/integration-test.yml
@@ -14,7 +14,7 @@ jobs:
     timeout-minutes: 15
     steps:
     - uses: linkerd/dev/actions/setup-tools@v41
-    - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
     - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84
       with:
         path: target/buildx
@@ -58,7 +58,7 @@ jobs:
         helm repo add linkerd-smi https://linkerd.github.io/linkerd-smi
         helm repo up
         helm install linkerd-smi -n linkerd-smi --create-namespace --wait linkerd-smi/linkerd-smi
-    - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
     - name: Install current linkerd-failover
       run: |
         helm install linkerd-failover -n linkerd-failover --create-namespace --wait \
diff --git a/.github/workflows/lints.yml b/.github/workflows/lints.yml
index 5ba6b60d..181a1053 100644
--- a/.github/workflows/lints.yml
+++ b/.github/workflows/lints.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     container: ghcr.io/linkerd/dev:v41-rust
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - run: just-cargo fmt -- --check
 
   clippy:
@@ -30,5 +30,5 @@ jobs:
     runs-on: ubuntu-latest
     container: ghcr.io/linkerd/dev:v41-rust
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - run: just-cargo clippy
diff --git a/.github/workflows/markdownlint.yml b/.github/workflows/markdownlint.yml
index 6ab04c97..cad08e61 100644
--- a/.github/workflows/markdownlint.yml
+++ b/.github/workflows/markdownlint.yml
@@ -14,7 +14,7 @@ jobs:
     timeout-minutes: 5
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - uses: DavidAnson/markdownlint-cli2-action@ed4dec634fd2ef689c7061d5647371d8248064f1
         with:
           globs: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 98933b0d..8022da2d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,7 +24,7 @@ jobs:
     steps:
     - uses: linkerd/dev/actions/setup-tools@v41
     - uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3
-    - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
     - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84
       with:
         path: target/buildx
@@ -52,7 +52,7 @@ jobs:
     needs: [docker-build]
     steps:
     - uses: linkerd/dev/actions/setup-tools@v41
-    - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
     - run: just-k3d create use
     - name: Install linkerd
       run: |
@@ -117,7 +117,7 @@ jobs:
       contents: write
     container: ghcr.io/linkerd/dev:v41-rust-musl
     steps:
-    - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
     - run: just fetch
     # TODO support alternate targets
     - run: just profile=release static=true target=x86_64-unknown-linux-musl cli-build
@@ -139,7 +139,7 @@ jobs:
         credentials_json: ${{ secrets.LINKERD_SITE_TOKEN }}
     - uses: google-github-actions/setup-gcloud@e30db14379863a8c79331b04a9969f4c1e225e0b
     - uses: linkerd/dev/actions/setup-tools@v41
-    - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
     - name: Publish edge helm chart
       if: contains(github.ref, '-edge')
       run: |
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index a36c9d05..efd5f2e1 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     container: ghcr.io/linkerd/dev:v41-rust
     steps:
-      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - run: just-cargo fetch --locked
       - run: just-cargo test-build --frozen --workspace
       - run: just-cargo test --frozen --workspace
@@ -33,7 +33,7 @@ jobs:
     runs-on: ubuntu-latest
     container: ghcr.io/linkerd/dev:v41-rust-musl
     steps:
-    - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
     - run: just fetch
     - run: just profile=debug static=true target=x86_64-unknown-linux-musl cli-build
     - run: mv "$(just --evaluate profile=debug target=x86_64-unknown-linux-musl cli-bin)" linkerd-failover-linux-amd64