diff --git a/.github/workflows/ci-checks.yml b/.github/workflows/ci-checks.yml
index ddf2a7dc..6d493b34 100644
--- a/.github/workflows/ci-checks.yml
+++ b/.github/workflows/ci-checks.yml
@@ -31,7 +31,7 @@ jobs:
     name: typecheck
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up Bun
         uses: oven-sh/setup-bun@v2
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a4511619..dee75307 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,7 +22,7 @@ jobs:
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v6
       - uses: DeterminateSystems/determinate-nix-action@v3.20.0
         with: &nix-install-with
           extra-conf: |
@@ -46,7 +46,7 @@ jobs:
       matrix: ${{ fromJson(needs.configure.outputs.matrix) }}
       fail-fast: false
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v6
       - name: Install Nix
         uses: DeterminateSystems/determinate-nix-action@v3.20.0
         with: *nix-install-with
diff --git a/.github/workflows/deploy-api.yaml b/.github/workflows/deploy-api.yaml
index 2bfd47cb..3f66affe 100644
--- a/.github/workflows/deploy-api.yaml
+++ b/.github/workflows/deploy-api.yaml
@@ -55,7 +55,7 @@ jobs:
       # the derivation hash matches across steps.
       STACKPANEL_ROOT_ABSOLUTE: ${{ github.workspace }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: DeterminateSystems/nix-installer-action@main
         with:
diff --git a/.github/workflows/deploy-docs.yaml b/.github/workflows/deploy-docs.yaml
index 17678588..a48aafd2 100644
--- a/.github/workflows/deploy-docs.yaml
+++ b/.github/workflows/deploy-docs.yaml
@@ -70,7 +70,7 @@ jobs:
       name: docs-${{ needs.stage.outputs.stage }}
       url: ${{ steps.deploy.outputs.url }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: oven-sh/setup-bun@v2
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -111,7 +111,7 @@ jobs:
       contents: read
       pull-requests: write    # sticky comment
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: oven-sh/setup-bun@v2
       - name: Install dependencies
         run: bun install --frozen-lockfile
diff --git a/.github/workflows/deploy-nixos.yml b/.github/workflows/deploy-nixos.yml
index 64c065cd..a8d652be 100644
--- a/.github/workflows/deploy-nixos.yml
+++ b/.github/workflows/deploy-nixos.yml
@@ -29,7 +29,7 @@ jobs:
     outputs:
       store-path: ${{ steps.build.outputs.store-path }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
@@ -66,7 +66,7 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
diff --git a/.github/workflows/deploy-web.yaml b/.github/workflows/deploy-web.yaml
index fdab0d67..49ad67de 100644
--- a/.github/workflows/deploy-web.yaml
+++ b/.github/workflows/deploy-web.yaml
@@ -72,7 +72,7 @@ jobs:
       name: ${{ needs.stage.outputs.stage }}
       url: ${{ steps.deploy.outputs.url }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: oven-sh/setup-bun@v2
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -138,7 +138,7 @@ jobs:
       contents: read
       pull-requests: write    # sticky comment
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: oven-sh/setup-bun@v2
       - name: Install dependencies
         run: bun install --frozen-lockfile
diff --git a/.github/workflows/devenv-cache.yml b/.github/workflows/devenv-cache.yml
index 436d1fd8..b8fa0b6d 100644
--- a/.github/workflows/devenv-cache.yml
+++ b/.github/workflows/devenv-cache.yml
@@ -35,7 +35,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install Nix
         uses: cachix/install-nix-action@v31
diff --git a/.github/workflows/provision-db.yml b/.github/workflows/provision-db.yml
index adc74754..abc8f1fd 100644
--- a/.github/workflows/provision-db.yml
+++ b/.github/workflows/provision-db.yml
@@ -28,7 +28,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Provision database and (optionally) restore snapshot
         shell: bash
diff --git a/.github/workflows/publish-seed-snapshot.yml b/.github/workflows/publish-seed-snapshot.yml
index 19c0d262..9c94c856 100644
--- a/.github/workflows/publish-seed-snapshot.yml
+++ b/.github/workflows/publish-seed-snapshot.yml
@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Create and upload snapshot
         shell: bash
diff --git a/.github/workflows/secrets-codegen-check.yml b/.github/workflows/secrets-codegen-check.yml
index c50f19e3..779545fa 100644
--- a/.github/workflows/secrets-codegen-check.yml
+++ b/.github/workflows/secrets-codegen-check.yml
@@ -66,7 +66,7 @@ jobs:
   verify:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
diff --git a/.github/workflows/test-fixtures.yml b/.github/workflows/test-fixtures.yml
index edd692cd..0b14e1ed 100644
--- a/.github/workflows/test-fixtures.yml
+++ b/.github/workflows/test-fixtures.yml
@@ -26,7 +26,7 @@ jobs:
     outputs:
       fixtures: ${{ steps.list.outputs.fixtures }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: List fixtures
         id: list
         run: |
@@ -48,7 +48,7 @@ jobs:
           - aarch64-darwin
       fail-fast: false
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main