diff --git a/.github/workflows/benches.yml b/.github/workflows/benches.yml
index 6b049ea6431..d5e2589920e 100644
--- a/.github/workflows/benches.yml
+++ b/.github/workflows/benches.yml
@@ -17,7 +17,7 @@ jobs:
   benchmarks:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5.0.1
+      - uses: actions/checkout@v6.0.0
       - uses: actions/setup-python@v6
         with:
           python-version: "3.13"
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 2b3ff0e8cc9..56c7a77d4c0 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -32,7 +32,7 @@ jobs:
     runs-on: ${{ inputs.os }}
     if: ${{ !(startsWith(inputs.python-version, 'graalpy') && startsWith(inputs.os, 'windows')) }}
     steps:
-      - uses: actions/checkout@v5.0.1
+      - uses: actions/checkout@v6.0.0
         with:
           # For PRs, we need to run on the real PR head, not the resultant merge of the PR into the target branch.
           #
diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml
index 1aeb00083d5..a46a5a8121d 100644
--- a/.github/workflows/changelog.yml
+++ b/.github/workflows/changelog.yml
@@ -9,7 +9,7 @@ jobs:
     name: Check changelog entry
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5.0.1
+      - uses: actions/checkout@v6.0.0
       - uses: actions/setup-python@v6
         with:
           python-version: '3.13'
diff --git a/.github/workflows/ci-cache-warmup.yml b/.github/workflows/ci-cache-warmup.yml
index d6c3df897f0..e7a63805e4d 100644
--- a/.github/workflows/ci-cache-warmup.yml
+++ b/.github/workflows/ci-cache-warmup.yml
@@ -9,7 +9,7 @@ jobs:
   cross-compilation-windows:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5.0.1
+      - uses: actions/checkout@v6.0.0
       - uses: actions/setup-python@v6
         with:
           python-version: "3.13"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5663a348202..381b096860e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,7 +17,7 @@ jobs:
   fmt:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5.0.1
+      - uses: actions/checkout@v6.0.0
       - uses: actions/setup-python@v6
         with:
           python-version: "3.13"
@@ -38,7 +38,7 @@ jobs:
       MSRV: ${{ steps.resolve-msrv.outputs.MSRV }}
       verbose: ${{ runner.debug == '1' }}
     steps:
-      - uses: actions/checkout@v5.0.1
+      - uses: actions/checkout@v6.0.0
       - uses: actions/setup-python@v6
         with:
           python-version: "3.13"
@@ -51,7 +51,7 @@ jobs:
     needs: [fmt]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5.0.1
+      - uses: actions/checkout@v6.0.0
       - uses: actions/setup-python@v6
         with:
           python-version: "3.13"
@@ -69,7 +69,7 @@ jobs:
     needs: [fmt, resolve]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5.0.1
+      - uses: actions/checkout@v6.0.0
       - uses: dtolnay/rust-toolchain@master
         with:
           toolchain: ${{ needs.resolve.outputs.MSRV }}
@@ -117,7 +117,7 @@ jobs:
     name: clippy/${{ matrix.target }}/${{ matrix.rust }}
     continue-on-error: ${{ matrix.rust != 'stable' }}
     steps:
-      - uses: actions/checkout@v5.0.1
+      - uses: actions/checkout@v6.0.0
       - uses: dtolnay/rust-toolchain@master
         with:
           toolchain: ${{ matrix.rust }}
@@ -390,7 +390,7 @@ jobs:
     needs: [fmt]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5.0.1
+      - uses: actions/checkout@v6.0.0
       - uses: actions/setup-python@v6
         with:
           python-version: "3.13"
@@ -411,7 +411,7 @@ jobs:
     needs: [fmt]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5.0.1
+      - uses: actions/checkout@v6.0.0
       - uses: actions/setup-python@v6
         with:
           python-version: "3.13"
@@ -433,7 +433,7 @@ jobs:
     needs: [fmt]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5.0.1
+      - uses: actions/checkout@v6.0.0
       - uses: actions/setup-python@v6
         with:
           python-version: "3.13"
@@ -451,7 +451,7 @@ jobs:
     needs: [fmt]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5.0.1
+      - uses: actions/checkout@v6.0.0
       - uses: actions/setup-python@v6
         with:
           # TODO bump emscripten builds to test on 3.13
@@ -492,7 +492,7 @@ jobs:
     needs: [fmt]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5.0.1
+      - uses: actions/checkout@v6.0.0
       - uses: Swatinem/rust-cache@v2
         with:
           save-if: ${{ github.ref == 'refs/heads/main' || contains(github.event.pull_request.labels.*.name, 'CI-save-pr-cache') }}
@@ -536,7 +536,7 @@ jobs:
     if: ${{ contains(github.event.pull_request.labels.*.name, 'CI-build-full') || github.event_name != 'pull_request' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5.0.1
+      - uses: actions/checkout@v6.0.0
       - uses: actions/setup-python@v6
         with:
           python-version: "3.13"
@@ -560,7 +560,7 @@ jobs:
         include:
           - rust: ${{ needs.resolve.outputs.MSRV }}
     steps:
-      - uses: actions/checkout@v5.0.1
+      - uses: actions/checkout@v6.0.0
       - uses: actions/setup-python@v6
         with:
           python-version: "3.13"
@@ -605,7 +605,7 @@ jobs:
             target: "aarch64-pc-windows-msvc"
             flags: "-i python3.13 --features generate-import-lib"
     steps:
-      - uses: actions/checkout@v5.0.1
+      - uses: actions/checkout@v6.0.0
       - uses: actions/setup-python@v6
         with:
           python-version: "3.13"
@@ -635,7 +635,7 @@ jobs:
     if: ${{ contains(github.event.pull_request.labels.*.name, 'CI-build-full') || github.event_name != 'pull_request' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5.0.1
+      - uses: actions/checkout@v6.0.0
       - uses: actions/setup-python@v6
         with:
           python-version: "3.13"
@@ -685,7 +685,7 @@ jobs:
           ]
     runs-on: ${{ matrix.platform.os }}
     steps:
-      - uses: actions/checkout@v5.0.1
+      - uses: actions/checkout@v6.0.0
       - uses: dtolnay/rust-toolchain@stable
         with:
           targets: ${{ matrix.platform.rust-target }}
@@ -707,7 +707,7 @@ jobs:
     if: ${{ !contains(github.event.pull_request.labels.*.name, 'CI-build-full') && github.event_name == 'pull_request' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5.0.1
+      - uses: actions/checkout@v6.0.0
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: rust-src
diff --git a/.github/workflows/coverage-pr-base.yml b/.github/workflows/coverage-pr-base.yml
index 427553a5fce..5c43b0367ab 100644
--- a/.github/workflows/coverage-pr-base.yml
+++ b/.github/workflows/coverage-pr-base.yml
@@ -12,7 +12,7 @@ jobs:
   coverage-pr-base:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5.0.1
+      - uses: actions/checkout@v6.0.0
       - uses: actions/setup-python@v6
         with:
           python-version: '3.13'
diff --git a/.github/workflows/netlify-build.yml b/.github/workflows/netlify-build.yml
index 8817724220a..e8d044debfe 100644
--- a/.github/workflows/netlify-build.yml
+++ b/.github/workflows/netlify-build.yml
@@ -21,7 +21,7 @@ jobs:
     outputs:
       tag_name: ${{ steps.prepare_tag.outputs.tag_name }}
     steps:
-      - uses: actions/checkout@v5.0.1
+      - uses: actions/checkout@v6.0.0
       - uses: actions/setup-python@v6
         with:
           python-version: "3.13"