diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 0bf0dcc..27af06f 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -41,7 +41,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 0
       - name: Prepare Release
@@ -81,7 +81,7 @@ jobs:
       CHARTS_DIR: charts/mermin
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 0
       - name: Prepare Release
diff --git a/.github/workflows/reusable_docker_build_multiarch.yaml b/.github/workflows/reusable_docker_build_multiarch.yaml
index 90efc77..d326234 100644
--- a/.github/workflows/reusable_docker_build_multiarch.yaml
+++ b/.github/workflows/reusable_docker_build_multiarch.yaml
@@ -220,7 +220,7 @@ jobs:
       MATRIX_TARGET: ${{ matrix.target }}
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - name: Normalize cache tag
         id: cache_tag
         env:
diff --git a/.github/workflows/reusable_go_checks.yml b/.github/workflows/reusable_go_checks.yml
index f86834d..1adad5d 100644
--- a/.github/workflows/reusable_go_checks.yml
+++ b/.github/workflows/reusable_go_checks.yml
@@ -73,7 +73,7 @@ jobs:
     timeout-minutes: ${{ inputs.timeout-minutes }}
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - name: Setup Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
@@ -93,7 +93,7 @@ jobs:
     timeout-minutes: ${{ inputs.timeout-minutes }}
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - name: Setup Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
@@ -112,7 +112,7 @@ jobs:
     timeout-minutes: ${{ inputs.timeout-minutes }}
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - name: Setup Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
@@ -130,7 +130,7 @@ jobs:
     timeout-minutes: ${{ inputs.timeout-minutes }}
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - name: Setup Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
@@ -147,7 +147,7 @@ jobs:
       image: returntocorp/semgrep
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - name: semgrep scan
         env:
           ARGS: ${{ inputs.semgrep_args }}
@@ -158,7 +158,7 @@ jobs:
     timeout-minutes: ${{ inputs.timeout-minutes }}
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 0
       - name: Setup Go
@@ -210,7 +210,7 @@ jobs:
     timeout-minutes: ${{ inputs.timeout-minutes }}
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 0
       - name: Setup Go
diff --git a/.github/workflows/reusable_goreleaser.yml b/.github/workflows/reusable_goreleaser.yml
index e209693..0ca0579 100644
--- a/.github/workflows/reusable_goreleaser.yml
+++ b/.github/workflows/reusable_goreleaser.yml
@@ -100,7 +100,7 @@ jobs:
     runs-on: ${{ inputs.runs_on }}
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
         with:
           token_format: "access_token"
diff --git a/.github/workflows/reusable_pr_checks.yml b/.github/workflows/reusable_pr_checks.yml
index 5dc0fee..f8283ff 100644
--- a/.github/workflows/reusable_pr_checks.yml
+++ b/.github/workflows/reusable_pr_checks.yml
@@ -18,7 +18,7 @@ jobs:
     timeout-minutes: ${{ inputs.timeout-minutes }}
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - name: Clean
         run:  |
           find . -mindepth 1 -maxdepth 1 -not -name '*commitlintrc*' -exec rm -rf {} \;
diff --git a/.github/workflows/reusable_python_checks.yml b/.github/workflows/reusable_python_checks.yml
index 546fe63..4eeb0b0 100644
--- a/.github/workflows/reusable_python_checks.yml
+++ b/.github/workflows/reusable_python_checks.yml
@@ -41,7 +41,7 @@ jobs:
     timeout-minutes: ${{ inputs.timeout-minutes }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
       - name: Set up Python
@@ -62,7 +62,7 @@ jobs:
     timeout-minutes: ${{ inputs.timeout-minutes }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 0
       - name: Install uv
diff --git a/.github/workflows/reusable_release_tag.yml b/.github/workflows/reusable_release_tag.yml
index 3bd1c58..e964fc8 100644
--- a/.github/workflows/reusable_release_tag.yml
+++ b/.github/workflows/reusable_release_tag.yml
@@ -40,7 +40,7 @@ jobs:
       version: ${{ steps.semver.outputs.version }}
       version_tag: ${{ steps.semver.outputs.version_tag }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 0
       - name: Bump semver
diff --git a/.github/workflows/reusable_renovate_checks.yml b/.github/workflows/reusable_renovate_checks.yml
index cd89027..886289f 100644
--- a/.github/workflows/reusable_renovate_checks.yml
+++ b/.github/workflows/reusable_renovate_checks.yml
@@ -9,6 +9,6 @@ jobs:
       image: renovate/renovate:latest
       options: --user root # root is needed for checkout to work
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - name: Validate Renovate config
         run: renovate-config-validator --strict
diff --git a/.github/workflows/reusable_tf_checks.yml b/.github/workflows/reusable_tf_checks.yml
index 9814201..0a1c4db 100644
--- a/.github/workflows/reusable_tf_checks.yml
+++ b/.github/workflows/reusable_tf_checks.yml
@@ -31,7 +31,7 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ contains(fromJson(inputs.checks_enabled), 'tf_fmt') }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - name: Setup terraform
         uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
       - name: Run terraform fmt
@@ -46,7 +46,7 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ contains(fromJson(inputs.checks_enabled), 'trivy_config_scan') }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - name: Run trivy config scan
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
@@ -62,7 +62,7 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ contains(fromJson(inputs.checks_enabled), 'tflint') }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         name: Cache plugin dir
         with:
@@ -89,7 +89,7 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ contains(fromJson(inputs.checks_enabled), 'terraform_docs') }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 0
       - name: Validate terraform docs are present and valid
diff --git a/actions/update-gitops/action.yml b/actions/update-gitops/action.yml
index 3c007bd..443b78e 100644
--- a/actions/update-gitops/action.yml
+++ b/actions/update-gitops/action.yml
@@ -43,7 +43,7 @@ outputs:
 runs:
   using: "composite"
   steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
     - name: Configure git
       shell: bash
       env:
@@ -71,7 +71,7 @@ runs:
         echo "commit_sha_short=$(git rev-parse --short origin/${DEFAULT_BRANCH})" >> $GITHUB_OUTPUT
         echo "commit_message_header=$(git log -1 --pretty=%s origin/${DEFAULT_BRANCH})" >> $GITHUB_OUTPUT
     - name: Checkout GitOps branch
-      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       with:
         ref: ${{ inputs.gitops_branch }}
     - name: Update manifests