diff --git a/.github/workflows/cargo-fmt.yml b/.github/workflows/cargo-fmt.yml
index e89923e2..3f29f7b4 100644
--- a/.github/workflows/cargo-fmt.yml
+++ b/.github/workflows/cargo-fmt.yml
@@ -20,7 +20,7 @@ jobs:
     name: cargo fmt
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
 
       - name: Install latest rust
         uses: dtolnay/rust-toolchain@stable
diff --git a/.github/workflows/documentation-build.yml b/.github/workflows/documentation-build.yml
index d96c2956..b1f0aa48 100644
--- a/.github/workflows/documentation-build.yml
+++ b/.github/workflows/documentation-build.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout CLI
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.2
 
       - name: Install latest rust
         uses: dtolnay/rust-toolchain@stable
@@ -43,7 +43,7 @@ jobs:
         run: make gen-md
 
       - name: Checkout documentation
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.2
         with:
           repository: kittycad/documentation
           path: docs
diff --git a/.github/workflows/flakehub.yml b/.github/workflows/flakehub.yml
index f8c45a99..30de0e37 100644
--- a/.github/workflows/flakehub.yml
+++ b/.github/workflows/flakehub.yml
@@ -10,7 +10,7 @@ jobs:
       id-token: "write"
       contents: "read"
     steps:
-      - uses: "actions/checkout@v6"
+      - uses: "actions/checkout@v6.0.2"
         with:
           persist-credentials: false
       - uses: "DeterminateSystems/determinate-nix-action@v3.21.0"
diff --git a/.github/workflows/generate-website-docs.yml b/.github/workflows/generate-website-docs.yml
index b442af9a..9d5b9e9c 100644
--- a/.github/workflows/generate-website-docs.yml
+++ b/.github/workflows/generate-website-docs.yml
@@ -16,7 +16,7 @@ jobs:
     name: make-release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
       - name: Install latest rust
         uses: dtolnay/rust-toolchain@stable
       - name: Cache cargo registry
@@ -50,7 +50,7 @@ jobs:
           private-key: ${{ secrets.GH_ORG_APP_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
       # Checkout the docs repo since we will want to update the files there.
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           repository: 'kittycad/documentation'
           path: 'docs'
diff --git a/.github/workflows/make-release.yml b/.github/workflows/make-release.yml
index c44ddd81..f59c83ab 100644
--- a/.github/workflows/make-release.yml
+++ b/.github/workflows/make-release.yml
@@ -13,7 +13,7 @@ jobs:
     name: make release
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
       - name: 'Authenticate to Google Cloud'
         uses: 'google-github-actions/auth@v3.0.0'
         with:
@@ -89,7 +89,7 @@ jobs:
     needs: [makerelease]
     name: createrelease
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
       - name: Install latest nightly
         uses: dtolnay/rust-toolchain@stable
       - uses: actions/download-artifact@v8
@@ -228,7 +228,7 @@ jobs:
           app-id: ${{ secrets.GH_ORG_APP_ID }}
           private-key: ${{ secrets.GH_ORG_APP_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           repository: 'kittycad/homebrew-kittycad'
           path: 'homebrew-kittycad'
diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml
index e36fb3ba..6efbf8ae 100644
--- a/.github/workflows/nix.yml
+++ b/.github/workflows/nix.yml
@@ -13,7 +13,7 @@ jobs:
   nix-flake-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           submodules: recursive
 
@@ -28,7 +28,7 @@ jobs:
   nix-build-linux:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           submodules: recursive
 
@@ -42,7 +42,7 @@ jobs:
   nix-build-macos:
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           submodules: recursive
 
diff --git a/.github/workflows/windows-install-directions.yml b/.github/workflows/windows-install-directions.yml
index 50cd4397..ddbbaf5a 100644
--- a/.github/workflows/windows-install-directions.yml
+++ b/.github/workflows/windows-install-directions.yml
@@ -33,7 +33,7 @@ jobs:
     name: install from generated directions
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
       - name: Install latest rust
         uses: dtolnay/rust-toolchain@stable
         with: