diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml
index 5fbd858..d39c65b 100644
--- a/.github/workflows/commitlint.yml
+++ b/.github/workflows/commitlint.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # fetch-depth 0 so the full PR commit range is available to lint.
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/contracts-ci.yml b/.github/workflows/contracts-ci.yml
index c3f9b02..7c499d0 100644
--- a/.github/workflows/contracts-ci.yml
+++ b/.github/workflows/contracts-ci.yml
@@ -33,7 +33,7 @@ jobs:
     name: Check & Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # rustup installs the exact toolchain, target and components pinned in
       # rust-toolchain.toml, so CI builds what a release is reproduced from.
@@ -55,7 +55,7 @@ jobs:
     name: Unit Tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # rustup installs the exact toolchain, target and components pinned in
       # rust-toolchain.toml, so CI builds what a release is reproduced from.
@@ -80,7 +80,7 @@ jobs:
     name: Build WASM Artifacts
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # rustup installs the exact toolchain, target and components pinned in
       # rust-toolchain.toml, so CI builds what a release is reproduced from.
@@ -129,7 +129,7 @@ jobs:
     name: Verify WASM Reproducibility
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v4.4.0
 
       - name: Install Rust toolchain
         run: rustup toolchain install && rustc --version
diff --git a/.github/workflows/labels-sync.yml b/.github/workflows/labels-sync.yml
index 5809408..14dfeca 100644
--- a/.github/workflows/labels-sync.yml
+++ b/.github/workflows/labels-sync.yml
@@ -16,7 +16,7 @@ jobs:
     name: Sync Repository Labels
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Sync labels
         uses: micnncim/action-label-syncer@021e162e244eb5329e46a7888b1364d9ebc6314c # v1.3.0
diff --git a/.github/workflows/line-endings.yml b/.github/workflows/line-endings.yml
index dd8a08c..3046ec4 100644
--- a/.github/workflows/line-endings.yml
+++ b/.github/workflows/line-endings.yml
@@ -17,7 +17,7 @@ jobs:
     name: No CRLF in tracked text files
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # `git ls-files --eol` reports the index end-of-line for every tracked
       # file. "i/crlf" or "i/mixed" means CRLF reached the repository.
diff --git a/.github/workflows/link-checker.yml b/.github/workflows/link-checker.yml
index 440bda8..67c10d7 100644
--- a/.github/workflows/link-checker.yml
+++ b/.github/workflows/link-checker.yml
@@ -23,7 +23,7 @@ jobs:
     name: Markdown Link Check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v4.4.0
 
       - name: Restore lychee cache
         uses: actions/cache@v4
diff --git a/.github/workflows/publish-sdk.yml b/.github/workflows/publish-sdk.yml
index 66b774d..745763e 100644
--- a/.github/workflows/publish-sdk.yml
+++ b/.github/workflows/publish-sdk.yml
@@ -33,7 +33,7 @@ jobs:
     environment: npm-publish
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # Node 24 bundles an npm new enough for trusted publishing. The dependency
       # cache stays off, so a release build never restores state that another
diff --git a/.github/workflows/sdk-ci.yml b/.github/workflows/sdk-ci.yml
index a7c1b0c..79e3552 100644
--- a/.github/workflows/sdk-ci.yml
+++ b/.github/workflows/sdk-ci.yml
@@ -20,7 +20,7 @@ jobs:
     name: Oracle parity fixture (Rust → JSON)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Install Rust toolchain
         run: rustup toolchain install && rustc --version
@@ -46,7 +46,7 @@ jobs:
         node-version: ["22", "24"]
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Setup Node.js ${{ matrix.node-version }}
         uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
@@ -75,7 +75,7 @@ jobs:
     name: Build Package
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
         with:
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index bc7d895..ddd126e 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -30,7 +30,7 @@ jobs:
     name: Cargo Audit (Rust advisory database)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # Pinned and --locked, so the auditor is the same build on every run.
       - name: Install cargo-audit
@@ -43,7 +43,7 @@ jobs:
     name: npm Audit (SDK runtime dependencies)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
         with:
@@ -60,5 +60,5 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request'
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - uses: actions/dependency-review-action@72eb423297a7cc29376c3e0026574f1a203f9052 # v4.5.0
diff --git a/.github/workflows/spell-check.yml b/.github/workflows/spell-check.yml
index b386eb1..945e9e4 100644
--- a/.github/workflows/spell-check.yml
+++ b/.github/workflows/spell-check.yml
@@ -27,7 +27,7 @@ jobs:
     name: Spell Check Docs
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Run cspell
         uses: streetsidesoftware/cspell-action@5f79a96ea6ff27cf6e511470438cf3ff9be3f92a # v6.0.0
diff --git a/.github/workflows/testnet-smoke.yml b/.github/workflows/testnet-smoke.yml
index e8298ec..d729ac2 100644
--- a/.github/workflows/testnet-smoke.yml
+++ b/.github/workflows/testnet-smoke.yml
@@ -34,7 +34,7 @@ jobs:
     timeout-minutes: 30
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # rustup installs the exact toolchain, target and components pinned in
       # rust-toolchain.toml, so CI builds what a release is reproduced from.
diff --git a/.github/workflows/unused-deps.yml b/.github/workflows/unused-deps.yml
index 0791379..818b72f 100644
--- a/.github/workflows/unused-deps.yml
+++ b/.github/workflows/unused-deps.yml
@@ -26,7 +26,7 @@ jobs:
     name: cargo-machete (unused Cargo dependencies)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # Pinned and --locked, so the checker is the same build on every run,
       # mirroring how security.yml installs cargo-audit.