diff --git a/.github/workflows/changeset-required.yml b/.github/workflows/changeset-required.yml
index 18d524b42..1b6a9bba6 100644
--- a/.github/workflows/changeset-required.yml
+++ b/.github/workflows/changeset-required.yml
@@ -16,14 +16,14 @@ jobs:
   changeset-lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd  # v5.0.1
         with:
           fetch-depth: 50
       - name: Fetch base ref for diff
         run: git fetch --depth=50 origin "${BASE_REF}:refs/remotes/origin/${BASE_REF}"
         env:
           BASE_REF: ${{ github.event.pull_request.base.ref }}
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444  # v5.0.0
         with:
           node-version: '24'
       - name: Run changeset lint
diff --git a/.github/workflows/docs-required.yml b/.github/workflows/docs-required.yml
index 5e10fd788..a6c8a213a 100644
--- a/.github/workflows/docs-required.yml
+++ b/.github/workflows/docs-required.yml
@@ -16,14 +16,14 @@ jobs:
   docs-lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd  # v5.0.1
         with:
           fetch-depth: 50
       - name: Fetch base ref for diff
         run: git fetch --depth=50 origin "${BASE_REF}:refs/remotes/origin/${BASE_REF}"
         env:
           BASE_REF: ${{ github.event.pull_request.base.ref }}
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444  # v5.0.0
         with:
           node-version: '24'
       - name: Run docs-required lint
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index c559e5ff8..1023d3c22 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -132,10 +132,10 @@ jobs:
             scope: windows
 
     steps:
-      # actions/checkout@v6 uses includeIf.gitdir: to inject auth on Windows.
-      # On Windows git 2.54, the gitdir path comparison is unreliable, so use
-      # v4 on Windows and v6 elsewhere.
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2 (Windows)
+      # Windows lane on checkout v5.0.1 (drops includeIf; no auth flake, uses Node 24 natively).
+      # v6 uses includeIf.gitdir: for auth injection; on Windows git 2.54 the path comparison is
+      # unreliable (https://github.com/actions/checkout/pull/2425). v5 never used includeIf.
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd  # v5.0.1 (Windows)
         if: runner.os == 'Windows'
         with:
           fetch-depth: 0
@@ -231,7 +231,7 @@ jobs:
             shell: 'zsh {0}'
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2 (Windows)
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd  # v5.0.1 (Windows)
         if: runner.os == 'Windows'
         with:
           fetch-depth: 0