diff --git a/.github/workflows/actions.yml b/.github/workflows/actions.yml
index 10c66646..a3ce64bd 100644
--- a/.github/workflows/actions.yml
+++ b/.github/workflows/actions.yml
@@ -18,7 +18,7 @@ jobs:
       - uses: linkerd/dev/actions/setup-tools@v49
         with:
           version: v49
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
       - run: just action-lint
 
   devcontainer-versions:
@@ -27,5 +27,5 @@ jobs:
       - uses: linkerd/dev/actions/setup-tools@v49
         with:
           version: v49
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
       - run: just action-dev-check
diff --git a/.github/workflows/cni-plugin-integration.yml b/.github/workflows/cni-plugin-integration.yml
index 746c78f6..090db34f 100644
--- a/.github/workflows/cni-plugin-integration.yml
+++ b/.github/workflows/cni-plugin-integration.yml
@@ -25,7 +25,7 @@ jobs:
       - uses: linkerd/dev/actions/setup-tools@v49
         with:
           version: v49
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
       - name: Run CNI integration tests
         env:
           IPTABLES_MODE: ${{ matrix.iptables-mode }}
@@ -38,7 +38,7 @@ jobs:
       - uses: linkerd/dev/actions/setup-tools@v49
         with:
           version: v49
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
       - name: Run CNI ordering tests
         run: just cni-plugin-test-ordering
   repair-controller:
@@ -48,6 +48,6 @@ jobs:
       - uses: linkerd/dev/actions/setup-tools@v49
         with:
           version: v49
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
       - name: Run repair-controller tests
         run: just cni-repair-controller-integration
diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index 9138e772..5743a067 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-24.04
     container: ghcr.io/linkerd/dev:v49-go
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
         with:
@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-24.04
     container: ghcr.io/linkerd/dev:v49-go
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
         with:
@@ -38,7 +38,7 @@ jobs:
     runs-on: ubuntu-24.04
     container: ghcr.io/linkerd/dev:v49-go
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
         with:
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index f502e1ee..c10f4bab 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -18,6 +18,6 @@ jobs:
       - uses: linkerd/dev/actions/setup-tools@v49
         with:
           version: v49
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
       - name: Run proxy-init integration tests
         run: just proxy-init-test-integration
diff --git a/.github/workflows/markdown.yml b/.github/workflows/markdown.yml
index 7c51d0be..e2ae72a5 100644
--- a/.github/workflows/markdown.yml
+++ b/.github/workflows/markdown.yml
@@ -14,7 +14,7 @@ jobs:
     timeout-minutes: 5
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
       - uses: DavidAnson/markdownlint-cli2-action@ded1f9488f68a970bc66ea5619e13e9b52e601cd
         with:
             globs: "**/*.md"
diff --git a/.github/workflows/release-cni-plugin.yml b/.github/workflows/release-cni-plugin.yml
index db65d8f0..e2244776 100644
--- a/.github/workflows/release-cni-plugin.yml
+++ b/.github/workflows/release-cni-plugin.yml
@@ -15,7 +15,7 @@ jobs:
     timeout-minutes: 3
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
       - id: meta
         uses: ./.github/actions/version-mode
         with:
@@ -44,7 +44,7 @@ jobs:
       - uses: linkerd/dev/actions/setup-tools@v49
         with:
           version: v49
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
       - run: |
           just cni-plugin-image='${{ needs.meta.outputs.repo }}:${{ needs.meta.outputs.version }}' \
                 build-cni-plugin-image \
@@ -82,7 +82,7 @@ jobs:
       contents: write
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
       - if: needs.meta.outputs.mode == 'release'
         uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b
         with:
diff --git a/.github/workflows/release-proxy-init.yml b/.github/workflows/release-proxy-init.yml
index 1a47e019..a30376eb 100644
--- a/.github/workflows/release-proxy-init.yml
+++ b/.github/workflows/release-proxy-init.yml
@@ -15,7 +15,7 @@ jobs:
     timeout-minutes: 3
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
       - uses: ./.github/actions/version-mode
         id: meta
         with:
@@ -44,7 +44,7 @@ jobs:
       - uses: linkerd/dev/actions/setup-tools@v49
         with:
           version: v49
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
       - run: |
           just proxy-init-image='${{ needs.meta.outputs.repo }}:${{ needs.meta.outputs.version }}' \
                 build-proxy-init-image \
@@ -82,7 +82,7 @@ jobs:
       contents: write
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
       - if: needs.meta.outputs.mode == 'release'
         uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b
         with:
diff --git a/.github/workflows/release-validator.yml b/.github/workflows/release-validator.yml
index 8e489b10..558e9718 100644
--- a/.github/workflows/release-validator.yml
+++ b/.github/workflows/release-validator.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-24.04
     container: ghcr.io/linkerd/dev:v49-rust
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
       - uses: ./.github/actions/version-mode
         id: meta
         with:
@@ -43,7 +43,7 @@ jobs:
       - name: Install MinGW
         if: matrix.os == 'windows'
         run: apt-get update && apt-get install mingw-w64 -y
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
       - run: just validator arch=${{ matrix.arch }} os=${{ matrix.os }} profile=release version=${{ needs.meta.outputs.version }} package
         env:
           CARGO: "cargo auditable"
@@ -63,7 +63,7 @@ jobs:
         with:
           path: ${{ runner.temp }}/artifacts
       - run: find "$RUNNER_TEMP"/artifacts -type f -ls
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
       - if: needs.meta.outputs.mode == 'release'
         uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b
         with:
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index ec4b4ce4..0f2faa77 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-24.04
     container: ghcr.io/linkerd/dev:v49-rust
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
       - run: just rs-fetch
       - run: just rs-fmt-check
       - run: just rs-clippy
diff --git a/.github/workflows/shell.yml b/.github/workflows/shell.yml
index 89088638..1d00d8ae 100644
--- a/.github/workflows/shell.yml
+++ b/.github/workflows/shell.yml
@@ -18,5 +18,5 @@ jobs:
       - uses: linkerd/dev/actions/setup-tools@v49
         with:
           version: v49
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
       - run: just sh-lint