diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 75cf7cf..939a75c 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -25,7 +25,7 @@ jobs:
         flavor: [default, debug]
     name: build (${{ matrix.cc }} / ${{ matrix.flavor }})
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: install build deps
         run: |
@@ -84,7 +84,7 @@ jobs:
     runs-on: ubuntu-latest
     name: sanitizers (ASan + UBSan)
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: install deps
         run: |
           sudo apt-get update -qq
@@ -115,7 +115,7 @@ jobs:
     name: clang-tidy
     continue-on-error: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: install deps
         run: |
           sudo apt-get update -qq
@@ -141,7 +141,7 @@ jobs:
     runs-on: ubuntu-latest
     name: drift-check (CISA KEV + Debian tracker)
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: cve_metadata drift
         run: |
           # Exits 1 if the federal data has drifted from our committed
@@ -168,7 +168,7 @@ jobs:
     runs-on: ubuntu-latest
     name: static-build
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: install build deps
         run: |
           sudo apt-get update -qq
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d0fba06..65d7644 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -32,7 +32,7 @@ jobs:
     name: build (${{ matrix.target }})
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: install build deps
         run: |
@@ -71,7 +71,7 @@ jobs:
     container:
       image: alpine:latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: install build deps
         run: apk add --no-cache build-base linux-headers tar
       - name: build static (musl)
@@ -111,7 +111,7 @@ jobs:
     runs-on: ubuntu-latest
     name: build (arm64-static / musl)
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: run dockcross arm64-musl build
         run: |
           # Fetch the dockcross wrapper script (handles UID/GID,
@@ -141,7 +141,7 @@ jobs:
     needs: [build, build-static-x86_64, build-static-arm64]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: actions/download-artifact@v4
         with: