diff --git a/.github/workflows/build-all-targets.yml b/.github/workflows/build-all-targets.yml
index 7615737c4..612f7e51a 100644
--- a/.github/workflows/build-all-targets.yml
+++ b/.github/workflows/build-all-targets.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       
       # remove this once the latest ubuntu image has been rolled out
       - name: Fix APT mirror (working patch)
@@ -57,7 +57,7 @@ jobs:
       labels: ubuntu-22.04-16core
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       
       # remove this once the latest ubuntu image has been rolled out
       - name: Fix APT mirror (working patch)
diff --git a/.github/workflows/build-and-push-base.yaml b/.github/workflows/build-and-push-base.yaml
index ec72b1fd0..3674eda1f 100644
--- a/.github/workflows/build-and-push-base.yaml
+++ b/.github/workflows/build-and-push-base.yaml
@@ -25,7 +25,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - name: Set up QEMU
         uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392
       - name: Set up Docker Buildx
diff --git a/.github/workflows/build-and-push-debug.yaml b/.github/workflows/build-and-push-debug.yaml
index ba135c99e..264883d05 100644
--- a/.github/workflows/build-and-push-debug.yaml
+++ b/.github/workflows/build-and-push-debug.yaml
@@ -23,7 +23,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - name: Set up QEMU
         uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392
       - name: Set up Docker Buildx
diff --git a/.github/workflows/build-and-push-hawk-server.yaml b/.github/workflows/build-and-push-hawk-server.yaml
index 9da0be652..e097ea208 100644
--- a/.github/workflows/build-and-push-hawk-server.yaml
+++ b/.github/workflows/build-and-push-hawk-server.yaml
@@ -29,7 +29,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - name: Set up QEMU
         uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392
       - name: Set up Docker Buildx
diff --git a/.github/workflows/build-and-push-nccl.yaml b/.github/workflows/build-and-push-nccl.yaml
index b1d71c7a0..c85b773fb 100644
--- a/.github/workflows/build-and-push-nccl.yaml
+++ b/.github/workflows/build-and-push-nccl.yaml
@@ -26,7 +26,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - name: Set up QEMU
         uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392
       - name: Set up Docker Buildx
diff --git a/.github/workflows/build-and-push-no-cuda.yaml b/.github/workflows/build-and-push-no-cuda.yaml
index a596a329f..290d06c5c 100644
--- a/.github/workflows/build-and-push-no-cuda.yaml
+++ b/.github/workflows/build-and-push-no-cuda.yaml
@@ -29,7 +29,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - name: Set up QEMU
         uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392
       - name: Set up Docker Buildx
diff --git a/.github/workflows/build-and-push-reshare-protocol.yaml b/.github/workflows/build-and-push-reshare-protocol.yaml
index 00e36dc6f..9fdf99fc2 100644
--- a/.github/workflows/build-and-push-reshare-protocol.yaml
+++ b/.github/workflows/build-and-push-reshare-protocol.yaml
@@ -36,7 +36,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - name: Set up QEMU
         uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392
       - name: Set up Docker Buildx
diff --git a/.github/workflows/build-and-push-shares-encoding.yaml b/.github/workflows/build-and-push-shares-encoding.yaml
index bc80e5016..e5dc2f25d 100644
--- a/.github/workflows/build-and-push-shares-encoding.yaml
+++ b/.github/workflows/build-and-push-shares-encoding.yaml
@@ -24,7 +24,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - name: Set up Docker
         uses: docker/setup-docker-action@b60f85385d03ac8acfca6d9996982511d8620a19
       - name: Set up Docker Buildx
diff --git a/.github/workflows/build-and-push-upgrade-hawk.yaml b/.github/workflows/build-and-push-upgrade-hawk.yaml
index dc5dcc7a6..0f954446e 100644
--- a/.github/workflows/build-and-push-upgrade-hawk.yaml
+++ b/.github/workflows/build-and-push-upgrade-hawk.yaml
@@ -29,7 +29,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - name: Set up QEMU
         uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392
       - name: Set up Docker Buildx
diff --git a/.github/workflows/build-and-push.yaml b/.github/workflows/build-and-push.yaml
index fc13e16c4..d451c9f97 100644
--- a/.github/workflows/build-and-push.yaml
+++ b/.github/workflows/build-and-push.yaml
@@ -25,7 +25,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - name: Set up QEMU
         uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392
       - name: Set up Docker Buildx
diff --git a/.github/workflows/check-licenses.yaml b/.github/workflows/check-licenses.yaml
index c492f5e89..04683c0af 100644
--- a/.github/workflows/check-licenses.yaml
+++ b/.github/workflows/check-licenses.yaml
@@ -13,7 +13,7 @@ jobs:
   cargo-deny:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # pin@v4.2.1
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # pin@v5.0.0
       - uses: EmbarkStudios/cargo-deny-action@f2ba7abc2abebaf185c833c3961145a3c275caad
         with:
           log-level: "error"
diff --git a/.github/workflows/cpu-genesis-e2e-tests.yaml b/.github/workflows/cpu-genesis-e2e-tests.yaml
index 5da0b7a69..c9e0ef551 100644
--- a/.github/workflows/cpu-genesis-e2e-tests.yaml
+++ b/.github/workflows/cpu-genesis-e2e-tests.yaml
@@ -16,7 +16,7 @@ jobs:
     runs-on:
       labels: ubuntu-22.04-16core
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
 
       - name: Get all test, doc and src files that have changed
         id: changed-files-yaml
diff --git a/.github/workflows/cpu-integration-tests.yaml b/.github/workflows/cpu-integration-tests.yaml
index bf0b44107..09c1c7bf2 100644
--- a/.github/workflows/cpu-integration-tests.yaml
+++ b/.github/workflows/cpu-integration-tests.yaml
@@ -16,7 +16,7 @@ jobs:
     runs-on:
       labels: ubuntu-22.04-16core
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
 
       - name: Get all test, doc and src files that have changed
         id: changed-files-yaml
diff --git a/.github/workflows/doc.yml b/.github/workflows/doc.yml
index 67d9d9023..cfd0adf8c 100644
--- a/.github/workflows/doc.yml
+++ b/.github/workflows/doc.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
 
       - name: Cache Rust build
         uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809
diff --git a/.github/workflows/lint-clippy.yaml b/.github/workflows/lint-clippy.yaml
index 1eac0af01..27684f6c0 100644
--- a/.github/workflows/lint-clippy.yaml
+++ b/.github/workflows/lint-clippy.yaml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
 
       - name: Get all test, doc and src files that have changed
         id: changed-files-yaml
diff --git a/.github/workflows/lint-rustfmt.yaml b/.github/workflows/lint-rustfmt.yaml
index 1ffa3b476..1b27b7e14 100644
--- a/.github/workflows/lint-rustfmt.yaml
+++ b/.github/workflows/lint-rustfmt.yaml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
 
       - name: Get all test, doc and src files that have changed
         id: changed-files-yaml
diff --git a/.github/workflows/run-unit-tests.yaml b/.github/workflows/run-unit-tests.yaml
index 07174c153..bb595065e 100644
--- a/.github/workflows/run-unit-tests.yaml
+++ b/.github/workflows/run-unit-tests.yaml
@@ -28,7 +28,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
 
       - name: Get all test, doc and src files that have changed
         id: changed-files-yaml
diff --git a/.github/workflows/temp-branch-build-and-push-hawk.yaml b/.github/workflows/temp-branch-build-and-push-hawk.yaml
index 78c798285..28f93cc09 100644
--- a/.github/workflows/temp-branch-build-and-push-hawk.yaml
+++ b/.github/workflows/temp-branch-build-and-push-hawk.yaml
@@ -25,7 +25,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - name: Set up QEMU
         uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392
       - name: Set up Docker Buildx
diff --git a/.github/workflows/temp-branch-build-and-push-upgrade-hawk.yaml b/.github/workflows/temp-branch-build-and-push-upgrade-hawk.yaml
index 87f9ae1d1..12d648a3f 100644
--- a/.github/workflows/temp-branch-build-and-push-upgrade-hawk.yaml
+++ b/.github/workflows/temp-branch-build-and-push-upgrade-hawk.yaml
@@ -25,7 +25,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - name: Set up QEMU
         uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392
       - name: Set up Docker Buildx
diff --git a/.github/workflows/temp-branch-build-and-push.yaml b/.github/workflows/temp-branch-build-and-push.yaml
index 6a141cb51..f1600f53f 100644
--- a/.github/workflows/temp-branch-build-and-push.yaml
+++ b/.github/workflows/temp-branch-build-and-push.yaml
@@ -25,7 +25,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - name: Set up QEMU
         uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392
       - name: Set up Docker Buildx
diff --git a/.github/workflows/test-gpu.yaml b/.github/workflows/test-gpu.yaml
index 660f043e9..98b4dbc2a 100644
--- a/.github/workflows/test-gpu.yaml
+++ b/.github/workflows/test-gpu.yaml
@@ -13,7 +13,7 @@ jobs:
     timeout-minutes: 20
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
 
       - name: Get all test, doc and src files that have changed
         id: changed-files-yaml