diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9ed3501..3ba65ca 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,7 +18,7 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v6.0.3
 
       - name: Set up Go
         uses: actions/setup-go@v6.4.0
diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index ae8cb11..7e2b76d 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -23,7 +23,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v6.0.3
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 0ae70f5..7c18790 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -26,7 +26,7 @@ jobs:
       actions: read # Required for Claude to read CI results on PRs
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v6.0.3
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml
index 0258d72..a232d56 100644
--- a/.github/workflows/govulncheck.yml
+++ b/.github/workflows/govulncheck.yml
@@ -23,7 +23,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v6.0.3
 
       - name: Set up Go
         uses: actions/setup-go@v6.4.0
diff --git a/.github/workflows/hardware-validation.yml b/.github/workflows/hardware-validation.yml
index d72c25f..f86c1f3 100644
--- a/.github/workflows/hardware-validation.yml
+++ b/.github/workflows/hardware-validation.yml
@@ -38,7 +38,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v6.0.3
         with:
           clean: true
           persist-credentials: false
diff --git a/.github/workflows/refresh-current-state.yml b/.github/workflows/refresh-current-state.yml
index 6584e6e..eb6d91f 100644
--- a/.github/workflows/refresh-current-state.yml
+++ b/.github/workflows/refresh-current-state.yml
@@ -16,7 +16,7 @@ jobs:
     name: Refresh current-state.md
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v6.0.3
         with:
           ref: main
           token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9d39719..f0887bb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -39,7 +39,7 @@ jobs:
     name: Test Gate
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v6.0.3
         with:
           fetch-depth: 0  # GoReleaser needs full history for changelog
 
@@ -99,7 +99,7 @@ jobs:
       version: ${{ steps.extract.outputs.version }}
       is_prerelease: ${{ steps.extract.outputs.is_prerelease }}
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v6.0.3
 
       - name: Extract version from tag and source
         id: extract
@@ -145,7 +145,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: test
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v6.0.3
 
       - name: Set up Go
         uses: actions/setup-go@v6.4.0
@@ -166,7 +166,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [test, validate-version, security]
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v6.0.3
         with:
           fetch-depth: 0
 
@@ -232,7 +232,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@v6.0.3
 
       - name: Set up Go
         uses: actions/setup-go@v6.4.0