diff --git a/.github/workflows/content-aware-hash.yml b/.github/workflows/content-aware-hash.yml
index 50e089b7b5d11..5af79c0ad54db 100644
--- a/.github/workflows/content-aware-hash.yml
+++ b/.github/workflows/content-aware-hash.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.1
 
       - name: Generate Hash
         run: |
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index a07d4ea1f536c..bc44b20f5ad11 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ github.repository == 'flutter/flutter' }}
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
       - name: ./bin/flutter test --coverage
         run: pushd packages/flutter;../../bin/flutter test --coverage -j 1;popd
       - name: upload coverage
diff --git a/.github/workflows/easy-cp.yml b/.github/workflows/easy-cp.yml
index aace3b159fdbc..7e5ac60074198 100644
--- a/.github/workflows/easy-cp.yml
+++ b/.github/workflows/easy-cp.yml
@@ -44,7 +44,7 @@ jobs:
         run: |
           echo "COMMIT_SHA=$(echo ${{ github.event.pull_request.merge_commit_sha }})" >> $GITHUB_ENV
       - name: Checkout Flutter Repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
         with:
           repository: flutteractionsbot/flutter
           path: flutter
diff --git a/.github/workflows/files-changed.yml b/.github/workflows/files-changed.yml
index 582ddc036aa27..2d54107096773 100644
--- a/.github/workflows/files-changed.yml
+++ b/.github/workflows/files-changed.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.1
 
       - name: Fetch base commit and origin/master
         # Fetch what to compare the commit against
@@ -35,7 +35,7 @@ jobs:
           ./bin/dart run dev/tools/bin/get_files_changed.dart --since="${{ github.event.pull_request.base.sha }}" > changed_files.json
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6
         with:
           name: changed-files
           path: changed_files.json
diff --git a/.github/workflows/lock.yaml b/.github/workflows/lock.yaml
index 365ac7398e0b7..e1b9355be94dd 100644
--- a/.github/workflows/lock.yaml
+++ b/.github/workflows/lock.yaml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ github.repository == 'flutter/flutter' }}
     steps:
-      - uses: dessant/lock-threads@1bf7ec25051fe7c00bdd17e6a7cf3d7bfb7dc771
+      - uses: dessant/lock-threads@7266a7ce5c1df01b1c6db85bf8cd86c737dadbe7
         with:
           process-only: 'issues'
           github-token: ${{ github.token }}
diff --git a/.github/workflows/merge-changelog.yml b/.github/workflows/merge-changelog.yml
index bad3b822ecf25..8084955484322 100644
--- a/.github/workflows/merge-changelog.yml
+++ b/.github/workflows/merge-changelog.yml
@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: Setup Repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.1
         with:
           repository: ${{ github.repository }}
           ref: master
diff --git a/.github/workflows/tool-test-general.yml b/.github/workflows/tool-test-general.yml
index d036140ff93fc..d27751b6eaa14 100644
--- a/.github/workflows/tool-test-general.yml
+++ b/.github/workflows/tool-test-general.yml
@@ -22,7 +22,7 @@ jobs:
 
     steps:
       # Note: we must check out the tree for the composite action to be available
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.1
       - uses: ./.github/actions/composite-flutter-setup
 
       - name: Tool Test