diff --git a/.github/workflows/beta.yml b/.github/workflows/beta.yml
index 3e1baca7b7..f49a1ba08d 100644
--- a/.github/workflows/beta.yml
+++ b/.github/workflows/beta.yml
@@ -31,6 +31,6 @@ jobs:
           curl --proto =https --tlsv1.3 -vsSfLo /usr/local/bin/cargo-action-fmt "https://github.com/olix0r/cargo-action-fmt/releases/download/release%2F${CARGO_ACTION_FMT_VERSION}/cargo-action-fmt-x86_64-unknown-linux-gnu"
           chmod 755 /usr/local/bin/cargo-action-fmt
       - run: rustup toolchain install --profile=minimal beta
-      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+      - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846
       - run: cargo +beta fetch
       - run: cargo +beta build --release -p linkerd2-proxy --message-format=json | cargo-action-fmt
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9c84313023..7b6f80b56a 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -28,6 +28,6 @@ jobs:
       - run: |
           curl --proto =https --tlsv1.3 -vsSfLo /usr/local/bin/cargo-action-fmt "https://github.com/olix0r/cargo-action-fmt/releases/download/release%2F${CARGO_ACTION_FMT_VERSION}/cargo-action-fmt-x86_64-unknown-linux-gnu"
           chmod 755 /usr/local/bin/cargo-action-fmt
-      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+      - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846
       - run: cargo fetch
       - run: cargo build --release -p linkerd2-proxy --message-format=json | cargo-action-fmt
diff --git a/.github/workflows/check-all.yml b/.github/workflows/check-all.yml
index 27ac93d36c..02302450bc 100644
--- a/.github/workflows/check-all.yml
+++ b/.github/workflows/check-all.yml
@@ -31,7 +31,7 @@ jobs:
       - run: |
           curl --proto =https --tlsv1.3 -vsSfLo /usr/local/bin/cargo-action-fmt "https://github.com/olix0r/cargo-action-fmt/releases/download/release%2F${CARGO_ACTION_FMT_VERSION}/cargo-action-fmt-x86_64-unknown-linux-gnu"
           chmod 755 /usr/local/bin/cargo-action-fmt
-      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+      - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846
       - run: cargo fetch
       - run: |
           cargo check --frozen \
diff --git a/.github/workflows/check-each.yml b/.github/workflows/check-each.yml
index c4e31b1ee0..d52c6c3d3c 100644
--- a/.github/workflows/check-each.yml
+++ b/.github/workflows/check-each.yml
@@ -30,7 +30,7 @@ jobs:
       image: docker://rust:1.59.0-buster
     steps:
       - run: apt update && apt install -y jq
-      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+      - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846
       - run: cargo fetch
       - uses: tj-actions/changed-files@0bc7d4006fb085334217ec5d6e6c288daade2f59
         id: changed-files
@@ -93,7 +93,7 @@ jobs:
       - name: install meshtls-boring build deps
         if: matrix.crate == 'linkerd-meshtls-boring'
         run: apt update && apt install -y clang cmake
-      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+      - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846
       - run: cargo fetch
       - run: cargo check -p ${{ matrix.crate }} --frozen --all-targets --message-format=json | cargo-action-fmt
 
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 9dd5121dc4..b7b7a233c1 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -29,7 +29,7 @@ jobs:
       options: --security-opt seccomp=unconfined # 🤷
     steps:
       - run: apt update && apt install -y cmake clang golang # for boring
-      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+      - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846
       - name: install cargo-tarpaulin ${{ env.CARGO_TARPAULIN_VERSION }}
         run: |
           cd "${CARGO_HOME}/bin"
diff --git a/.github/workflows/deps.yml b/.github/workflows/deps.yml
index 01bbf75b75..101d01f792 100644
--- a/.github/workflows/deps.yml
+++ b/.github/workflows/deps.yml
@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-latest
     continue-on-error: true
     steps:
-    - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+    - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846
     - uses: EmbarkStudios/cargo-deny-action@8acbae97b5d01b0481ae14cee8fcd8f5aa9e374d
       with:
         command: check advisories
@@ -35,7 +35,7 @@ jobs:
     timeout-minutes: 10
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+    - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846
     - uses: EmbarkStudios/cargo-deny-action@8acbae97b5d01b0481ae14cee8fcd8f5aa9e374d
       with:
         command: check bans licenses sources
diff --git a/.github/workflows/devcontainer.yml b/.github/workflows/devcontainer.yml
index 1d66fdae50..6e9a5de145 100644
--- a/.github/workflows/devcontainer.yml
+++ b/.github/workflows/devcontainer.yml
@@ -15,13 +15,13 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+      - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846
       - run: docker build .devcontainer
 
   devcontainer-image:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+      - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846
       - run: |
           export DEBIAN_FRONTEND=noninteractive
           sudo apt-get update
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 8b91a436da..6573a3c988 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -15,5 +15,5 @@ jobs:
     env:
       DOCKER_BUILDKIT: "1"
     steps:
-      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+      - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846
       - run: docker build . --build-arg PROXY_UNOPTIMIZED=1
diff --git a/.github/workflows/fuzzers.yml b/.github/workflows/fuzzers.yml
index 2775b22063..f5802b38cd 100644
--- a/.github/workflows/fuzzers.yml
+++ b/.github/workflows/fuzzers.yml
@@ -29,7 +29,7 @@ jobs:
       image: docker://rust:1.59.0-buster
     steps:
       - run: apt update && apt install -y jo
-      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+      - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846
       - uses: tj-actions/changed-files@0bc7d4006fb085334217ec5d6e6c288daade2f59
         id: changed-files
       - name: list changed crates
@@ -86,7 +86,7 @@ jobs:
     steps:
       - run: rustup toolchain add nightly
       - run: cargo install cargo-fuzz
-      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+      - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846
       - working-directory: ${{matrix.dir}}
         run: cargo +nightly fetch
       - working-directory: ${{matrix.dir}}
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index 8140adb634..5026342451 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -28,7 +28,7 @@ jobs:
     container:
       image: docker://rust:1.59.0-buster
     steps:
-      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+      - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846
       - run: |
           cargo test --no-run \
             --package=linkerd-app \
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 14ead2e2ac..4dd41cc8c5 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -28,7 +28,7 @@ jobs:
           curl --proto =https --tlsv1.3 -vsSfLo /usr/local/bin/cargo-action-fmt "https://github.com/olix0r/cargo-action-fmt/releases/download/release%2F${CARGO_ACTION_FMT_VERSION}/cargo-action-fmt-x86_64-unknown-linux-gnu"
           chmod 755 /usr/local/bin/cargo-action-fmt
       - run: rustup component add clippy
-      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+      - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846
       - run: cargo fetch
       - run: cargo clippy --all --exclude=linkerd-meshtls-boring --message-format=json | cargo-action-fmt
 
@@ -39,7 +39,7 @@ jobs:
       image: docker://rust:1.59.0-buster
     steps:
       - run: rustup component add rustfmt
-      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+      - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846
       - run: make check-fmt
 
   docs:
@@ -51,7 +51,7 @@ jobs:
       - run: |
           curl --proto =https --tlsv1.3 -vsSfLo /usr/local/bin/cargo-action-fmt "https://github.com/olix0r/cargo-action-fmt/releases/download/release%2F${CARGO_ACTION_FMT_VERSION}/cargo-action-fmt-x86_64-unknown-linux-gnu"
           chmod 755 /usr/local/bin/cargo-action-fmt
-      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+      - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846
       - run: cargo fetch
       - run: |
           cargo doc --all --no-deps \
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 6955799aa2..9162b9b1f4 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -31,6 +31,6 @@ jobs:
           curl --proto =https --tlsv1.3 -vsSfLo /usr/local/bin/cargo-action-fmt "https://github.com/olix0r/cargo-action-fmt/releases/download/release%2F${CARGO_ACTION_FMT_VERSION}/cargo-action-fmt-x86_64-unknown-linux-gnu"
           chmod 755 /usr/local/bin/cargo-action-fmt
       - run: rustup toolchain install --profile=minimal nightly
-      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+      - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846
       - run: cargo +nightly fetch
       - run: cargo +nightly build --release -p linkerd2-proxy --message-format=json | cargo-action-fmt
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 314fe7cb39..d056eccd53 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -36,7 +36,7 @@ jobs:
     timeout-minutes: 40
     steps:
       - name: git co
-        uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+        uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846
 
       - name: meta
         id: release-tag-meta
@@ -77,7 +77,7 @@ jobs:
       contents: write
     steps:
       - name: git co
-        uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+        uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846
 
       - name: meta
         id: release-tag-meta
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index d1dda321c5..325ebd60d7 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -28,7 +28,7 @@ jobs:
       image: docker://rust:1.59.0-buster
     steps:
       - run: apt update && apt install -y cmake clang golang # for boring
-      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+      - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846
       - working-directory: ./linkerd/meshtls
         run: cargo test --all-features --no-run
       - working-directory: ./linkerd/meshtls
@@ -61,7 +61,7 @@ jobs:
     container:
       image: docker://rust:1.59.0-buster
     steps:
-      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+      - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846
       - run: |
           cargo test --all --no-run \
             --exclude=linkerd-app \
diff --git a/.github/workflows/toolchain.yml b/.github/workflows/toolchain.yml
index c925528e46..8165b87c98 100644
--- a/.github/workflows/toolchain.yml
+++ b/.github/workflows/toolchain.yml
@@ -18,7 +18,7 @@ jobs:
   dockerfiles:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+      - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846
       - run: |
           VERSION="$(cat rust-toolchain)"
           ex=0
@@ -38,7 +38,7 @@ jobs:
   workflows:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+      - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846
       - run: |
           curl --proto '=https' --tlsv1.3 -vsSfLo /usr/local/bin/yq "https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64" \
             && chmod +x /usr/local/bin/yq