diff --git a/.github/workflows/add-label-community-pr.yml b/.github/workflows/add-label-community-pr.yml
index 98d185c728fda7..558dbb95580bd8 100644
--- a/.github/workflows/add-label-community-pr.yml
+++ b/.github/workflows/add-label-community-pr.yml
@@ -23,7 +23,7 @@ jobs:
           scope: DataDog/datadog-agent
           policy: self.add-labels-pr.label-pr
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: main
           token: ${{ steps.octo-sts.outputs.token }}
diff --git a/.github/workflows/add-label-pr.yml b/.github/workflows/add-label-pr.yml
index 3266270ebdf497..8d65d0a82a9091 100644
--- a/.github/workflows/add-label-pr.yml
+++ b/.github/workflows/add-label-pr.yml
@@ -24,7 +24,7 @@ jobs:
           scope: DataDog/datadog-agent
           policy: self.add-labels-pr.label-pr
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           sparse-checkout: |
             .gitlab-ci.yml
diff --git a/.github/workflows/add-milestone.yml b/.github/workflows/add-milestone.yml
index 901c01959fb319..53c2fb6cc2399f 100644
--- a/.github/workflows/add-milestone.yml
+++ b/.github/workflows/add-milestone.yml
@@ -22,7 +22,7 @@ jobs:
       GH_REPO: ${{ github.repository }}
     steps:
       - name: Checkout datadog-agent repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/add-reviewer-bot-pr.yml b/.github/workflows/add-reviewer-bot-pr.yml
index 171e17c664f38d..ee95059855b922 100644
--- a/.github/workflows/add-reviewer-bot-pr.yml
+++ b/.github/workflows/add-reviewer-bot-pr.yml
@@ -36,7 +36,7 @@ jobs:
           policy: self.add-reviewer-bot-pr.review-pr
 
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           token: ${{ steps.octo-sts.outputs.token }}
diff --git a/.github/workflows/ask-review.yml b/.github/workflows/ask-review.yml
index 5d51d761a88605..62dbf23c717f3e 100644
--- a/.github/workflows/ask-review.yml
+++ b/.github/workflows/ask-review.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Install dda
diff --git a/.github/workflows/assess-permissions.yml b/.github/workflows/assess-permissions.yml
index 460ac5bb597f47..2c2b6b95267087 100644
--- a/.github/workflows/assess-permissions.yml
+++ b/.github/workflows/assess-permissions.yml
@@ -30,7 +30,7 @@ jobs:
       name: main
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           sparse-checkout: |
             .dda
@@ -56,7 +56,7 @@ jobs:
       name: main
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           sparse-checkout: |
             .dda
diff --git a/.github/workflows/assign-issue-triage.yml b/.github/workflows/assign-issue-triage.yml
index 3a0cb32453fb75..168680e24fce9c 100644
--- a/.github/workflows/assign-issue-triage.yml
+++ b/.github/workflows/assign-issue-triage.yml
@@ -22,7 +22,7 @@ jobs:
         policy: self.assign-issue.label-issue
 
     - name: Checkout repository
-      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         token: ${{ steps.octo-sts.outputs.token }}
 
diff --git a/.github/workflows/assign-issue.yml b/.github/workflows/assign-issue.yml
index d55362ad5c0801..d35fe3c4ffee01 100644
--- a/.github/workflows/assign-issue.yml
+++ b/.github/workflows/assign-issue.yml
@@ -37,7 +37,7 @@ jobs:
       issues: read
     steps:
     - name: Checkout repository
-      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
     - name: Get issue details
       id: get-issue
diff --git a/.github/workflows/backport-pr.yml b/.github/workflows/backport-pr.yml
index e8b01f46db2629..33d315684251c9 100644
--- a/.github/workflows/backport-pr.yml
+++ b/.github/workflows/backport-pr.yml
@@ -57,7 +57,7 @@ jobs:
           scope: DataDog/datadog-agent
           policy: self.backport-pr.create-pr
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0 # needed to get the full history of the PR
 
diff --git a/.github/workflows/buildimages-update.yml b/.github/workflows/buildimages-update.yml
index b8201a4c453be5..89aec81244fde0 100644
--- a/.github/workflows/buildimages-update.yml
+++ b/.github/workflows/buildimages-update.yml
@@ -37,7 +37,7 @@ jobs:
 
     steps:
       - name: Checkout branch
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           # credentials are needed to create the PR at the end of the workflow
           persist-credentials: true
@@ -55,7 +55,7 @@ jobs:
           fi
 
       - name: Checkout branch
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         if: ${{ steps.branch_fetch.outputs.RESULT == 'true' }}
         with:
           ref: ${{ inputs.branch }}
diff --git a/.github/workflows/chase-for-qa-cards.yml b/.github/workflows/chase-for-qa-cards.yml
index 833291667de6a6..892694fe6ea2aa 100644
--- a/.github/workflows/chase-for-qa-cards.yml
+++ b/.github/workflows/chase-for-qa-cards.yml
@@ -17,7 +17,7 @@ jobs:
       name: main
     steps:
     - name: Checkout repository
-      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         ref: ${{ github.head_ref }}
         persist-credentials: false
diff --git a/.github/workflows/chase-release-managers.yml b/.github/workflows/chase-release-managers.yml
index 92c787b1cea7ef..1bcf99fe266627 100644
--- a/.github/workflows/chase-release-managers.yml
+++ b/.github/workflows/chase-release-managers.yml
@@ -17,7 +17,7 @@ jobs:
       name: main
     steps:
     - name: Checkout repository
-      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         ref: ${{ github.head_ref }}
         persist-credentials: false
diff --git a/.github/workflows/code-review-complexity.yml b/.github/workflows/code-review-complexity.yml
index ef56d95291a303..26a0f477d61384 100644
--- a/.github/workflows/code-review-complexity.yml
+++ b/.github/workflows/code-review-complexity.yml
@@ -20,7 +20,7 @@ jobs:
     if: github.event.pull_request.head.repo.full_name == github.repository # Run only on non-fork PRs
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Install dda
diff --git a/.github/workflows/collector-generate-and-update.yml b/.github/workflows/collector-generate-and-update.yml
index 5ff4b81edc0d01..b30377c3682700 100644
--- a/.github/workflows/collector-generate-and-update.yml
+++ b/.github/workflows/collector-generate-and-update.yml
@@ -12,7 +12,7 @@ jobs:
       id-token: write # This is required for getting the required OIDC token from GitHub
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up Go
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
diff --git a/.github/workflows/create-rc-pr.yml b/.github/workflows/create-rc-pr.yml
index 212d7867b800cf..c13ef2fc1716d8 100644
--- a/.github/workflows/create-rc-pr.yml
+++ b/.github/workflows/create-rc-pr.yml
@@ -16,7 +16,7 @@ jobs:
       name: main
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           sparse-checkout: |
             .dda
@@ -46,7 +46,7 @@ jobs:
           policy: self.create-rc-pr.create-pr
 
       - name: Checkout the main branch
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: true
           token: ${{ steps.octo-sts.outputs.token }}
diff --git a/.github/workflows/create-release-schedule.yml b/.github/workflows/create-release-schedule.yml
index 0b3cf5da8e1b18..b334bdaf1d9e5a 100644
--- a/.github/workflows/create-release-schedule.yml
+++ b/.github/workflows/create-release-schedule.yml
@@ -22,7 +22,7 @@ jobs:
       name: main
     steps:
     - name: Checkout repository
-      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         ref: ${{ github.head_ref }}
         persist-credentials: false
diff --git a/.github/workflows/cws-btfhub-sync.yml b/.github/workflows/cws-btfhub-sync.yml
index 9a6b3d12755dfa..fce2e07585b6c8 100644
--- a/.github/workflows/cws-btfhub-sync.yml
+++ b/.github/workflows/cws-btfhub-sync.yml
@@ -47,13 +47,13 @@ jobs:
           df -h
 
       - name: Checkout datadog-agent repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ inputs.base_branch || 'main' }}
           persist-credentials: false
 
       - name: Checkout btfhub-archive repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           repository: DataDog/btfhub-archive
           path: dev/dist/archive
@@ -99,7 +99,7 @@ jobs:
       id-token: write # This is required for getting the required OIDC token from GitHub
     steps:
       - name: Checkout datadog-agent repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ inputs.base_branch || 'main' }}
 
diff --git a/.github/workflows/docs-dev.yml b/.github/workflows/docs-dev.yml
index d2a659117424aa..8055b5faa7c866 100644
--- a/.github/workflows/docs-dev.yml
+++ b/.github/workflows/docs-dev.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         persist-credentials: false
         # Fetch all history for applying timestamps to every page
diff --git a/.github/workflows/go-update-commenter.yml b/.github/workflows/go-update-commenter.yml
index 91683d63494700..1be85de54567ba 100644
--- a/.github/workflows/go-update-commenter.yml
+++ b/.github/workflows/go-update-commenter.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # get the Go version of the target branch
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ github.base_ref }}
           persist-credentials: false
@@ -26,7 +26,7 @@ jobs:
           echo version="$(cat .go-version)" >> $GITHUB_OUTPUT
 
       # get the Go version of the PR branch
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Get current Go version
diff --git a/.github/workflows/gohai.yml b/.github/workflows/gohai.yml
index 2a152bf28fcf91..429096267a4fe4 100644
--- a/.github/workflows/gohai.yml
+++ b/.github/workflows/gohai.yml
@@ -35,7 +35,7 @@ jobs:
         go-file: [.go-version, pkg/gohai/go.mod]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
diff --git a/.github/workflows/label-analysis.yml b/.github/workflows/label-analysis.yml
index 40426201b4d84d..ec68453a497928 100644
--- a/.github/workflows/label-analysis.yml
+++ b/.github/workflows/label-analysis.yml
@@ -22,7 +22,7 @@ jobs:
       # NOTE: Do NOT use sparse-checkout here — reno uses dulwich which doesn't
       # support the extensions.worktreeConfig that sparse-checkout enables.
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: main
           fetch-depth: 0
@@ -92,7 +92,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: main
           sparse-checkout: |
@@ -115,7 +115,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ github.head_ref }}
       - name: Install dda
diff --git a/.github/workflows/markdown-lint-check.yml b/.github/workflows/markdown-lint-check.yml
index 4e9b1e44e64526..dcb0ff046cb96f 100644
--- a/.github/workflows/markdown-lint-check.yml
+++ b/.github/workflows/markdown-lint-check.yml
@@ -9,7 +9,7 @@ jobs:
   markdown-link-check:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         persist-credentials: false
     - uses: tcort/github-action-markdown-link-check@e7c7a18363c842693fadde5d41a3bd3573a7a225 # v1.1.2
diff --git a/.github/workflows/report-merged-pr.yml b/.github/workflows/report-merged-pr.yml
index c3a361bc4d50a9..ab05e77af36a09 100644
--- a/.github/workflows/report-merged-pr.yml
+++ b/.github/workflows/report-merged-pr.yml
@@ -16,7 +16,7 @@ jobs:
       name: main
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/test-devcontainer.yml b/.github/workflows/test-devcontainer.yml
index 53b096c8e71417..fca4f34a398e24 100644
--- a/.github/workflows/test-devcontainer.yml
+++ b/.github/workflows/test-devcontainer.yml
@@ -28,7 +28,7 @@ jobs:
         | jq -s 'add' > pr-files.json
 
     - name: Fetch changed files (push)
-      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       if: github.event_name == 'push'
       with:
         persist-credentials: false
@@ -76,7 +76,7 @@ jobs:
         os: [ubuntu-latest, ubuntu-24.04-arm]
 
     steps:
-    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         persist-credentials: false
         fetch-depth: 1000
diff --git a/.github/workflows/update-dependencies.yml b/.github/workflows/update-dependencies.yml
index e17abd5daa9758..ed642478e42424 100644
--- a/.github/workflows/update-dependencies.yml
+++ b/.github/workflows/update-dependencies.yml
@@ -25,7 +25,7 @@ jobs:
         with:
           scope: DataDog/datadog-agent
           policy: self.update-dependencies.create-pr
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           # credentials are needed to create the PR at the end of the workflow
           persist-credentials: true
diff --git a/.github/workflows/update-kubernetes-versions.yml b/.github/workflows/update-kubernetes-versions.yml
index e1421a408c9d2c..f7949278bdf98f 100644
--- a/.github/workflows/update-kubernetes-versions.yml
+++ b/.github/workflows/update-kubernetes-versions.yml
@@ -41,7 +41,7 @@ jobs:
           scope: DataDog/datadog-agent
           policy: self.update-kubernetes-versions.create-pr
 
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: true
           token: ${{ steps.octo-sts.outputs.token }}
diff --git a/.github/workflows/upgrade-python-patch-version.yml b/.github/workflows/upgrade-python-patch-version.yml
index bdb7ac4cb30d65..5d8e60ab1e8fba 100644
--- a/.github/workflows/upgrade-python-patch-version.yml
+++ b/.github/workflows/upgrade-python-patch-version.yml
@@ -23,7 +23,7 @@ jobs:
           scope: DataDog/datadog-agent
           policy: self.upgrade-python-version.create-pr
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           # credentials are needed to create the PR at the end of the workflow
           persist-credentials: true