diff --git a/.github/workflows/dev-workflow.yml b/.github/workflows/dev-workflow.yml
index b65897f5..d5200f65 100644
--- a/.github/workflows/dev-workflow.yml
+++ b/.github/workflows/dev-workflow.yml
@@ -40,7 +40,7 @@ jobs:
             tuf-repo-cdn.sigstore.dev:443
             oauth2.sigstore.dev:443
 
-      - uses: OZI-Project/checkpoint@5eb7b6ec9ba2eec71a0418270d92e9a6d81d285f # 1.4.0
+      - uses: OZI-Project/checkpoint@e8968b10918a82bf03e196f5feac1669ccdf98e2 # 1.5.3
         with:
           python-version: "3.10"
           parallel: false
@@ -73,7 +73,7 @@ jobs:
             tuf-repo-cdn.sigstore.dev:443
             oauth2.sigstore.dev:443
 
-      - uses: OZI-Project/checkpoint@5eb7b6ec9ba2eec71a0418270d92e9a6d81d285f # 1.4.0
+      - uses: OZI-Project/checkpoint@e8968b10918a82bf03e196f5feac1669ccdf98e2 # 1.5.3
         with:
           python-version: "3.11"
 
@@ -105,7 +105,7 @@ jobs:
             tuf-repo-cdn.sigstore.dev:443
             oauth2.sigstore.dev:443
 
-      - uses: OZI-Project/checkpoint@5eb7b6ec9ba2eec71a0418270d92e9a6d81d285f # 1.4.0
+      - uses: OZI-Project/checkpoint@e8968b10918a82bf03e196f5feac1669ccdf98e2 # 1.5.3
         with:
           python-version: "3.12"
 
@@ -138,6 +138,6 @@ jobs:
             index.crates.io:443
             static.crates.io:443
 
-      - uses: OZI-Project/checkpoint@5eb7b6ec9ba2eec71a0418270d92e9a6d81d285f
+      - uses: OZI-Project/checkpoint@e8968b10918a82bf03e196f5feac1669ccdf98e2
         with:
           python-version: "3.13"
diff --git a/.github/workflows/dist-workflow.yml b/.github/workflows/dist-workflow.yml
index 69068065..d6bfca00 100644
--- a/.github/workflows/dist-workflow.yml
+++ b/.github/workflows/dist-workflow.yml
@@ -41,7 +41,7 @@ jobs:
             tuf-repo-cdn.sigstore.dev:443
             oauth2.sigstore.dev:443
 
-      - uses: OZI-Project/checkpoint@5eb7b6ec9ba2eec71a0418270d92e9a6d81d285f # 1.4.0
+      - uses: OZI-Project/checkpoint@e8968b10918a82bf03e196f5feac1669ccdf98e2 # 1.5.3
         with:
           python-version: "3.10"
           parallel: false
@@ -73,7 +73,7 @@ jobs:
             tuf-repo-cdn.sigstore.dev:443
             oauth2.sigstore.dev:443
 
-      - uses: OZI-Project/checkpoint@5eb7b6ec9ba2eec71a0418270d92e9a6d81d285f # 1.4.0
+      - uses: OZI-Project/checkpoint@e8968b10918a82bf03e196f5feac1669ccdf98e2 # 1.5.3
         with:
           python-version: "3.11"
           parallel: false
@@ -105,7 +105,7 @@ jobs:
             tuf-repo-cdn.sigstore.dev:443
             oauth2.sigstore.dev:443
 
-      - uses: OZI-Project/checkpoint@5eb7b6ec9ba2eec71a0418270d92e9a6d81d285f # 1.4.0
+      - uses: OZI-Project/checkpoint@e8968b10918a82bf03e196f5feac1669ccdf98e2 # 1.5.3
         with:
           python-version: "3.12"
           parallel: false
@@ -136,7 +136,7 @@ jobs:
             rekor.sigstore.dev:443
             tuf-repo-cdn.sigstore.dev:443
 
-      - uses: OZI-Project/checkpoint@5eb7b6ec9ba2eec71a0418270d92e9a6d81d285f
+      - uses: OZI-Project/checkpoint@e8968b10918a82bf03e196f5feac1669ccdf98e2
         with:
           python-version: "3.13"