diff --git a/.github/workflows/ghcr-image-build-and-publish.yml b/.github/workflows/ghcr-image-build-and-publish.yml
index f60446202e3..e9512c5b062 100644
--- a/.github/workflows/ghcr-image-build-and-publish.yml
+++ b/.github/workflows/ghcr-image-build-and-publish.yml
@@ -31,7 +31,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3  # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
 
       # FIXME: setup-qemu-action is depended by `gomodjail pack`
       - name: Set up QEMU
diff --git a/.github/workflows/job-build.yml b/.github/workflows/job-build.yml
index 88a6dc9e3d1..42078e59c95 100644
--- a/.github/workflows/job-build.yml
+++ b/.github/workflows/job-build.yml
@@ -35,7 +35,7 @@ jobs:
 
     steps:
       - name: "Init: checkout"
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3  # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/job-lint-go.yml b/.github/workflows/job-lint-go.yml
index afab345faef..e6f528e9bdf 100644
--- a/.github/workflows/job-lint-go.yml
+++ b/.github/workflows/job-lint-go.yml
@@ -39,7 +39,7 @@ jobs:
 
     steps:
       - name: "Init: checkout"
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3  # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/job-lint-other.yml b/.github/workflows/job-lint-other.yml
index ff00d9f9d02..4de2f1457b8 100644
--- a/.github/workflows/job-lint-other.yml
+++ b/.github/workflows/job-lint-other.yml
@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - name: "Init: checkout"
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3  # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/job-lint-project.yml b/.github/workflows/job-lint-project.yml
index 96b772ae477..1af262636c3 100644
--- a/.github/workflows/job-lint-project.yml
+++ b/.github/workflows/job-lint-project.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
       - name: "Init: checkout"
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3  # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
         with:
           fetch-depth: 100
           path: src/github.com/containerd/nerdctl
diff --git a/.github/workflows/job-test-dependencies.yml b/.github/workflows/job-test-dependencies.yml
index ee4e21daf71..61c55559ae0 100644
--- a/.github/workflows/job-test-dependencies.yml
+++ b/.github/workflows/job-test-dependencies.yml
@@ -31,7 +31,7 @@ jobs:
 
     steps:
       - name: "Init: checkout"
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3  # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/job-test-in-container.yml b/.github/workflows/job-test-in-container.yml
index e82a96e8eff..43790b93e4d 100644
--- a/.github/workflows/job-test-in-container.yml
+++ b/.github/workflows/job-test-in-container.yml
@@ -67,7 +67,7 @@ jobs:
 
     steps:
       - name: "Init: checkout"
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3  # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/job-test-in-host.yml b/.github/workflows/job-test-in-host.yml
index b797c39f0cf..8cba6f34c90 100644
--- a/.github/workflows/job-test-in-host.yml
+++ b/.github/workflows/job-test-in-host.yml
@@ -71,7 +71,7 @@ jobs:
 
     steps:
       - name: "Init: checkout"
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3  # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/job-test-in-lima.yml b/.github/workflows/job-test-in-lima.yml
index a0f9ed58000..6d9fafb81c1 100644
--- a/.github/workflows/job-test-in-lima.yml
+++ b/.github/workflows/job-test-in-lima.yml
@@ -30,7 +30,7 @@ jobs:
       TARGET: ${{ inputs.target }}
     steps:
       - name: "Init: checkout"
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3  # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/job-test-in-vagrant.yml b/.github/workflows/job-test-in-vagrant.yml
index 2840a4e6527..fbd67dad75f 100644
--- a/.github/workflows/job-test-in-vagrant.yml
+++ b/.github/workflows/job-test-in-vagrant.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: "${{ inputs.runner }}"
     steps:
       - name: "Init: checkout"
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3  # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/job-test-unit.yml b/.github/workflows/job-test-unit.yml
index b896e44fb77..316916809ef 100644
--- a/.github/workflows/job-test-unit.yml
+++ b/.github/workflows/job-test-unit.yml
@@ -46,7 +46,7 @@ jobs:
 
     steps:
       - name: "Init: checkout"
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3  # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 320e5640ac7..8d4a7efdbca 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -23,7 +23,7 @@ jobs:
       id-token: write  # for provenances
       attestations: write  # for provenances
     steps:
-    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3  # v6.0.0
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
     # FIXME: setup-qemu-action is depended by `gomodjail pack`
     - name: "Set up QEMU"
       uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130  # v3.7.0
diff --git a/.github/workflows/workflow-flaky.yml b/.github/workflows/workflow-flaky.yml
index cb74fb27401..f6c6d890090 100644
--- a/.github/workflows/workflow-flaky.yml
+++ b/.github/workflows/workflow-flaky.yml
@@ -46,7 +46,7 @@ jobs:
       ROOTFUL: true
     steps:
       - name: "Init: checkout"
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3  # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
         with:
           fetch-depth: 1
       - name: "Run"
diff --git a/.github/workflows/workflow-tigron.yml b/.github/workflows/workflow-tigron.yml
index e3399d36cf6..91511735664 100644
--- a/.github/workflows/workflow-tigron.yml
+++ b/.github/workflows/workflow-tigron.yml
@@ -32,7 +32,7 @@ jobs:
             canary: go-canary
     steps:
       - name: "Checkout project"
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3  # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
         with:
           fetch-depth: 100
       - if: ${{ matrix.canary }}