diff --git a/.github/workflows/autofix.yaml b/.github/workflows/autofix.yaml
index ac89fb72c..00242efaa 100644
--- a/.github/workflows/autofix.yaml
+++ b/.github/workflows/autofix.yaml
@@ -52,7 +52,7 @@ jobs:
       is_python_project: ${{ steps.project-metadata.outputs.is_python_project }}
       blacken_docs_params: ${{ steps.project-metadata.outputs.blacken_docs_params }}
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@v5.0.1
       - uses: astral-sh/setup-uv@v7.1.3
       - name: Run gha-utils metadata
         id: project-metadata
@@ -71,7 +71,7 @@ jobs:
     if: needs.project-metadata.outputs.python_files || needs.project-metadata.outputs.doc_files
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@v5.0.1
       - uses: astral-sh/setup-uv@v7.1.3
       - name: Run autopep8
         if: needs.project-metadata.outputs.python_files
@@ -170,7 +170,7 @@ jobs:
     if: fromJSON(needs.project-metadata.outputs.is_python_project)
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@v5.0.1
       - uses: astral-sh/setup-uv@v7.1.3
       - name: Sync uv.lock
         run: |
@@ -200,7 +200,7 @@ jobs:
     if: needs.project-metadata.outputs.markdown_files
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@v5.0.1
       - uses: astral-sh/setup-uv@v7.1.3
       - name: Install mdformat
         run: >
@@ -251,7 +251,7 @@ jobs:
     if: needs.project-metadata.outputs.json_files
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@v5.0.1
       - name: Install ESLint with JSON support
         run: |
           npm --no-progress install --no-save "eslint@9.36.0" "@eslint/json@0.13.2"
@@ -348,7 +348,7 @@ jobs:
     if: fromJSON(needs.project-metadata.outputs.gitignore_exists)
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@v5.0.1
       - name: Install git-extras
         run: |
           sudo apt update
diff --git a/.github/workflows/changelog.yaml b/.github/workflows/changelog.yaml
index b4e77611b..36e117dc1 100644
--- a/.github/workflows/changelog.yaml
+++ b/.github/workflows/changelog.yaml
@@ -33,7 +33,7 @@ jobs:
           - minor
           - major
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@v5.0.1
       - uses: astral-sh/setup-uv@v7.1.3
       - name: Install bump-my-version
         run: >
@@ -97,7 +97,7 @@ jobs:
     # XXX This cannot be done because there is no way to group "replace" actions into a collection. Maybe we should
     # start to discuss this upstream.
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@v5.0.1
       - uses: astral-sh/setup-uv@v7.1.3
       - name: Install bump-my-version
         run: >
diff --git a/.github/workflows/debug.yaml b/.github/workflows/debug.yaml
index 17fe89884..b4589c554 100644
--- a/.github/workflows/debug.yaml
+++ b/.github/workflows/debug.yaml
@@ -15,7 +15,7 @@ jobs:
     outputs:
       build_targets: ${{ steps.project-metadata.outputs.build_targets }}
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@v5.0.1
       - uses: astral-sh/setup-uv@v7.1.3
       - name: Run gha-utils metadata
         id: project-metadata
diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml
index 2359b387b..f7c1fdddd 100644
--- a/.github/workflows/docs.yaml
+++ b/.github/workflows/docs.yaml
@@ -31,7 +31,7 @@ jobs:
     name: Fix typos
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@v5.0.1
       - uses: crate-ci/typos@v1.39.2
         with:
           write_changes: true
@@ -68,7 +68,7 @@ jobs:
       is_sphinx: ${{ steps.project-metadata.outputs.is_sphinx }}
       active_autodoc: ${{ steps.project-metadata.outputs.active_autodoc }}
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@v5.0.1
       - uses: astral-sh/setup-uv@v7.1.3
       - name: Run gha-utils metadata
         id: project-metadata
@@ -87,7 +87,7 @@ jobs:
     if: needs.project-metadata.outputs.image_files
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@v5.0.1
       - uses: calibreapp/image-actions@1.4.1
         id: image_actions
         with:
@@ -120,7 +120,7 @@ jobs:
     if: fromJSON(needs.project-metadata.outputs.mailmap_exists)
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@v5.0.1
         with:
           # Fetch all history to extract all contributors.
           fetch-depth: 0
@@ -156,7 +156,7 @@ jobs:
     if: fromJSON(needs.project-metadata.outputs.is_python_project)
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@v5.0.1
       - uses: astral-sh/setup-uv@v7.1.3
       - name: Install pipdeptree
         run: |
@@ -212,7 +212,7 @@ jobs:
       && fromJSON(needs.project-metadata.outputs.active_autodoc)
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@v5.0.1
       - uses: astral-sh/setup-uv@v7.1.3
       - name: Run Sphinx
         run: |
@@ -242,7 +242,7 @@ jobs:
     if: fromJSON(needs.project-metadata.outputs.is_python_project) && fromJSON(needs.project-metadata.outputs.is_sphinx)
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@v5.0.1
       - uses: astral-sh/setup-uv@v7.1.3
       - name: Install Graphviz
         # So we can use the sphinx.ext.graphviz plugin.
@@ -270,7 +270,7 @@ jobs:
     # files from awesome-template.
     steps:
       - name: Initial checkout
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@v5.0.1
         with:
           token: ${{ secrets.WORKFLOW_UPDATE_GITHUB_PAT || secrets.GITHUB_TOKEN }}
           fetch-depth: 0
diff --git a/.github/workflows/labeller-content-based.yaml b/.github/workflows/labeller-content-based.yaml
index 79038ef63..2465f4be7 100644
--- a/.github/workflows/labeller-content-based.yaml
+++ b/.github/workflows/labeller-content-based.yaml
@@ -34,7 +34,7 @@ jobs:
       && github.actor != 'dependabot-preview[bot]'
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@v5.0.1
       - name: Download default rules
         run: >
           curl -fsSL --output ./.github/labeller-content-based.yaml
diff --git a/.github/workflows/labeller-file-based.yaml b/.github/workflows/labeller-file-based.yaml
index 419d49fe7..cfb3bbebe 100644
--- a/.github/workflows/labeller-file-based.yaml
+++ b/.github/workflows/labeller-file-based.yaml
@@ -31,7 +31,7 @@ jobs:
       && github.actor != 'dependabot-preview[bot]'
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@v5.0.1
       - name: Download default rules
         run: >
           curl -fsSL --output ./.github/labeller-file-based.yaml
diff --git a/.github/workflows/labels.yaml b/.github/workflows/labels.yaml
index a74fb5c45..48a1b0142 100644
--- a/.github/workflows/labels.yaml
+++ b/.github/workflows/labels.yaml
@@ -24,7 +24,7 @@ jobs:
     name: Sync labels
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@v5.0.1
       - name: Sync labels
         uses: julb/action-manage-label@1.0.1
         env:
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index 356b19a5e..7da8fbe5f 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -31,7 +31,7 @@ jobs:
       is_python_project: ${{ steps.project-metadata.outputs.is_python_project }}
       mypy_params: ${{ steps.project-metadata.outputs.mypy_params }}
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@v5.0.1
       - uses: astral-sh/setup-uv@v7.1.3
       - name: Run gha-utils metadata
         id: project-metadata
@@ -50,7 +50,7 @@ jobs:
     if: github.head_ref != 'prepare-release' && needs.project-metadata.outputs.python_files
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@v5.0.1
       - uses: astral-sh/setup-uv@v7.1.3
       - name: Install all package dependencies
         run: |
@@ -75,7 +75,7 @@ jobs:
       && needs.project-metadata.outputs.yaml_files
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@v5.0.1
       - uses: astral-sh/setup-uv@v7.1.3
       - name: Run yamllint
         run: >
@@ -94,7 +94,7 @@ jobs:
       && needs.project-metadata.outputs.zsh_files
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@v5.0.1
       - name: Install Zsh
         run: |
           sudo apt update
@@ -113,7 +113,7 @@ jobs:
       && needs.project-metadata.outputs.workflow_files
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@v5.0.1
       - name: Install actionlint
         id: install_actionlint
         run: |
@@ -160,7 +160,7 @@ jobs:
     # action blindly creates issues ad-nauseam. See: https://github.com/peter-evans/create-issue-from-file/issues/298 .
     # This was also discussed at: https://github.com/lycheeverse/lychee-action/issues/74#issuecomment-1587089689
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@v5.0.1
       - uses: lycheeverse/lychee-action@v2.7.0
         id: lychee_run
         with:
@@ -268,7 +268,7 @@ jobs:
       && github.head_ref != 'prepare-release'
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@v5.0.1
         with:
           # Fetch all history to please linter's age checks.
           fetch-depth: 0
@@ -287,7 +287,7 @@ jobs:
     if: github.head_ref != 'prepare-release' && ! fromJson(needs.project-metadata.outputs.is_bot)
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@v5.0.1
         with:
           fetch-depth: 0
       - uses: gitleaks/gitleaks-action@v2.3.9
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index e322df029..3d231eb22 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -73,7 +73,7 @@ jobs:
       package_name: ${{ steps.project-metadata.outputs.package_name }}
       release_notes: ${{ steps.project-metadata.outputs.release_notes }}
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@v5.0.1
         with:
           # Checkout pull request HEAD commit to ignore actions/checkout's merge commit. Fallback to push SHA.
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
@@ -107,7 +107,7 @@ jobs:
       matrix: ${{ fromJSON(needs.project-metadata.outputs.new_commits_matrix) }}
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@v5.0.1
         with:
           ref: ${{ matrix.commit }}
       - uses: astral-sh/setup-uv@v7.1.3
@@ -133,7 +133,7 @@ jobs:
     # We keep going when a job flagged as not stable fails.
     continue-on-error: ${{ matrix.state == 'unstable' }}
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@v5.0.1
         with:
           ref: ${{ matrix.commit }}
       - uses: astral-sh/setup-uv@v7.1.3
@@ -262,7 +262,7 @@ jobs:
     # We keep going when a job flagged as not stable fails.
     continue-on-error: ${{ matrix.state == 'unstable' }}
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@v5.0.1
         with:
           ref: ${{ matrix.commit }}
       - name: Download artifact
@@ -296,7 +296,7 @@ jobs:
       matrix: ${{ fromJSON(needs.project-metadata.outputs.release_commits_matrix) }}
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@v5.0.1
         with:
           ref: ${{ matrix.commit }}
           # XXX We need custom PAT with workflows permissions because tag generation will work but it will not trigger
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index 3ddd0ba40..0df5b23ab 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -49,7 +49,7 @@ jobs:
     # We keep going when a job flagged as not stable fails.
     continue-on-error: ${{ matrix.state == 'unstable' }}
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@v5.0.1
       - uses: astral-sh/setup-uv@v7.1.3
       - name: Install Python ${{ matrix.python-version }}
         # If UV cannot find the requested Python version, it exits with code 2, which let the job pass unnoticed on
@@ -96,7 +96,7 @@ jobs:
     outputs:
       build_targets: ${{ steps.project-metadata.outputs.build_targets }}
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@v5.0.1
       - uses: astral-sh/setup-uv@v7.1.3
       - name: Run gha-utils metadata
         id: project-metadata