diff --git a/.github/workflows/vps_codex_service_ops.yml b/.github/workflows/vps_codex_service_ops.yml
index 5ffffe1..441985b 100644
--- a/.github/workflows/vps_codex_service_ops.yml
+++ b/.github/workflows/vps_codex_service_ops.yml
@@ -34,7 +34,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout Bridge
-        uses: actions/checkout@v6.0.3
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Verify trusted QPK drift workflow refs
         env:
diff --git a/tests/test_run_monthly_codex_audit.py b/tests/test_run_monthly_codex_audit.py
index c2c3319..9e67ade 100644
--- a/tests/test_run_monthly_codex_audit.py
+++ b/tests/test_run_monthly_codex_audit.py
@@ -2425,7 +2425,7 @@ def test_vps_ops_workflow_runs_only_manual_self_hosted_ops(self) -> None:
         self.assertIn("QuantStrategyLab/CryptoLivePoolPipelines", workflow)
         self.assertIn("QuantStrategyLab/CryptoStrategies/.github/workflows/drift-check.yml@refs/heads/main", workflow)
         self.assertNotIn("QuantStrategyLab/CodexAuditBridge", workflow)
-        self.assertIn("actions/checkout@v6.0.3", workflow)
+        self.assertIn("actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3", workflow)
 
     def test_vps_deploy_adds_nginx_audit_route_without_router_service(self) -> None:
         deploy_script = Path("scripts/deploy_codex_audit_service.sh").read_text(encoding="utf-8")