diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index cbfa46b37..e771b4631 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -26,7 +26,7 @@ jobs:
           - javascript-typescript
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.3
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4.36.2
diff --git a/.github/workflows/crabbox-hydrate.yml b/.github/workflows/crabbox-hydrate.yml
index 8826e90b2..91847f1c9 100644
--- a/.github/workflows/crabbox-hydrate.yml
+++ b/.github/workflows/crabbox-hydrate.yml
@@ -35,7 +35,7 @@ jobs:
     runs-on: [self-hosted, crabbox, openclaw, docs, "${{ inputs.crabbox_runner_label }}"]
     timeout-minutes: 120
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.3
         with:
           ref: ${{ inputs.ref || github.ref }}
 
diff --git a/.github/workflows/docs-code-ci.yml b/.github/workflows/docs-code-ci.yml
index 00288077b..964233cd9 100644
--- a/.github/workflows/docs-code-ci.yml
+++ b/.github/workflows/docs-code-ci.yml
@@ -30,7 +30,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Check out
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.3
 
       - name: Set up Node
         uses: actions/setup-node@v6
diff --git a/.github/workflows/llms-full.yml b/.github/workflows/llms-full.yml
index 40b46f87e..3cf284c60 100644
--- a/.github/workflows/llms-full.yml
+++ b/.github/workflows/llms-full.yml
@@ -25,7 +25,7 @@ jobs:
       url: https://docs.openclaw.ai/llms-full.txt
     steps:
       - name: Check out
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.3
 
       - name: Check current docs main
         id: current-main
@@ -84,7 +84,7 @@ jobs:
 
       - name: Check out OpenClaw source
         if: steps.current-main.outputs.stale != 'true' && steps.live-route.outputs.available != 'false'
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.3
         with:
           repository: ${{ steps.source-meta.outputs.repository }}
           ref: ${{ steps.source-meta.outputs.sha }}
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 285cb1d1c..0580cd00b 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -41,7 +41,7 @@ jobs:
       url: https://docs.openclaw.ai
     steps:
       - name: Check out
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.3
 
       - name: Set up Node
         uses: actions/setup-node@v6
diff --git a/.github/workflows/r2-pages.yml b/.github/workflows/r2-pages.yml
index 2c758ad88..98fa87bc3 100644
--- a/.github/workflows/r2-pages.yml
+++ b/.github/workflows/r2-pages.yml
@@ -55,7 +55,7 @@ jobs:
       url: https://docs.openclaw.ai
     steps:
       - name: Check out
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.3
 
       - name: Classify artifact scope
         id: artifact-scope
@@ -117,7 +117,7 @@ jobs:
 
       - name: Check out OpenClaw source
         if: steps.artifact-scope.outputs.scope == 'full'
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.3
         with:
           repository: ${{ steps.source-meta.outputs.repository }}
           ref: ${{ steps.source-meta.outputs.sha }}
diff --git a/.github/workflows/translate-all.yml b/.github/workflows/translate-all.yml
index c6d05077b..49345075b 100644
--- a/.github/workflows/translate-all.yml
+++ b/.github/workflows/translate-all.yml
@@ -62,7 +62,7 @@ jobs:
       source_sha: ${{ steps.prepare.outputs.source_sha }}
     steps:
       - name: Check out
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.3
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/translate-finalize-reusable.yml b/.github/workflows/translate-finalize-reusable.yml
index a72998e9d..90d366f63 100644
--- a/.github/workflows/translate-finalize-reusable.yml
+++ b/.github/workflows/translate-finalize-reusable.yml
@@ -26,7 +26,7 @@ jobs:
       cancel-in-progress: false
     steps:
       - name: Check out latest main
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.3
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/translate-incremental.yml b/.github/workflows/translate-incremental.yml
index 8976ebb6c..fdaf2805c 100644
--- a/.github/workflows/translate-incremental.yml
+++ b/.github/workflows/translate-incremental.yml
@@ -58,7 +58,7 @@ jobs:
       source_sha: ${{ steps.prepare.outputs.source_sha }}
     steps:
       - name: Check out
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.3
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/translate-locale-reusable.yml b/.github/workflows/translate-locale-reusable.yml
index d8b1b0611..2bfb70797 100644
--- a/.github/workflows/translate-locale-reusable.yml
+++ b/.github/workflows/translate-locale-reusable.yml
@@ -43,7 +43,7 @@ jobs:
       cancel-in-progress: false
     steps:
       - name: Checkout publish repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.3
         with:
           ref: ${{ inputs.publish_ref }}
           fetch-depth: 0
@@ -74,7 +74,7 @@ jobs:
 
       - name: Checkout source repo
         if: steps.stale.outputs.skip != 'true'
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.3
         with:
           repository: ${{ steps.meta.outputs.repository }}
           ref: ${{ steps.meta.outputs.sha }}
diff --git a/.github/workflows/translate-shell-check-reusable.yml b/.github/workflows/translate-shell-check-reusable.yml
index 39a441c87..92435bb19 100644
--- a/.github/workflows/translate-shell-check-reusable.yml
+++ b/.github/workflows/translate-shell-check-reusable.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.3
 
       - name: Check bash syntax in translation workflows
         run: |