diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index c84ab4f..0a987b9 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -10,7 +10,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
 
     - name: Set up Go
       uses: actions/setup-go@v5
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index 400ef6d..87e7914 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -15,7 +15,7 @@ jobs:
     name: "Lint Go"
     runs-on: "depot-ubuntu-24.04"
     steps:
-      - uses: "actions/checkout@v5"
+      - uses: "actions/checkout@v6"
       - uses: "authzed/actions/setup-go@main"
       - name: "Lint Go"
         run: "go run mage.go lint:go"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fb18727..2667b2b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -18,7 +18,7 @@ jobs:
   goreleaser:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4.2.2
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v4.2.2
         with:
           # Allow goreleaser to access older tag information.
           fetch-depth: 0
diff --git a/.github/workflows/update-openapi-spec.yml b/.github/workflows/update-openapi-spec.yml
index 4a56188..0b11ba8 100644
--- a/.github/workflows/update-openapi-spec.yml
+++ b/.github/workflows/update-openapi-spec.yml
@@ -23,7 +23,7 @@ jobs:
     
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           # For PRs, check out the head of the PR
           ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.ref || '' }}