diff --git a/.github/workflows/all-documents.yml b/.github/workflows/all-documents.yml
index 58ce83b578df..f52aebfb8374 100644
--- a/.github/workflows/all-documents.yml
+++ b/.github/workflows/all-documents.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repo
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - uses: ./.github/actions/node-npm-setup
 
diff --git a/.github/workflows/article-api-docs.yml b/.github/workflows/article-api-docs.yml
index e6552f4fa380..b856b43b8b3b 100644
--- a/.github/workflows/article-api-docs.yml
+++ b/.github/workflows/article-api-docs.yml
@@ -22,7 +22,7 @@ jobs:
     if: github.repository == 'github/docs-internal' || github.repository == 'github/docs'
     steps:
       - name: Checkout
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - uses: ./.github/actions/node-npm-setup
 
diff --git a/.github/workflows/auto-add-ready-for-doc-review.yml b/.github/workflows/auto-add-ready-for-doc-review.yml
index 4a78f5a76d66..3d556a58d65a 100644
--- a/.github/workflows/auto-add-ready-for-doc-review.yml
+++ b/.github/workflows/auto-add-ready-for-doc-review.yml
@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - name: Check out repo
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Check team membership
         id: membership_check
diff --git a/.github/workflows/check-broken-links-github-github.yml b/.github/workflows/check-broken-links-github-github.yml
index 9ed65c286704..18a02d903acd 100644
--- a/.github/workflows/check-broken-links-github-github.yml
+++ b/.github/workflows/check-broken-links-github-github.yml
@@ -24,7 +24,7 @@ jobs:
       REPORT_REPOSITORY: github/docs-content
     steps:
       - name: Checkout
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           # To prevent issues with cloning early access content later
           persist-credentials: 'false'
diff --git a/.github/workflows/close-on-invalid-label.yaml b/.github/workflows/close-on-invalid-label.yaml
index 7c7e12b3d478..cf68f22a396b 100644
--- a/.github/workflows/close-on-invalid-label.yaml
+++ b/.github/workflows/close-on-invalid-label.yaml
@@ -37,7 +37,7 @@ jobs:
 
       - name: Check out repo
         if: ${{ failure() && github.event_name != 'pull_request_target' }}
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - uses: ./.github/actions/slack-alert
         if: ${{ failure() && github.event_name != 'pull_request_target' }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 39a961119a60..f6bc4e7e872e 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -33,7 +33,7 @@ jobs:
     if: github.repository == 'github/docs-internal' || github.repository == 'github/docs'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: github/codeql-action/init@e296a935590eb16afc0c0108289f68c87e2a89a5 # v4.30.7
         with:
           languages: javascript # comma separated list of values from {go, python, javascript, java, cpp, csharp, ruby}
diff --git a/.github/workflows/confirm-internal-staff-work-in-docs.yml b/.github/workflows/confirm-internal-staff-work-in-docs.yml
index 776157ce8acf..00dd5c555a6a 100644
--- a/.github/workflows/confirm-internal-staff-work-in-docs.yml
+++ b/.github/workflows/confirm-internal-staff-work-in-docs.yml
@@ -83,7 +83,7 @@ jobs:
 
       - name: Check out repo
         if: ${{ failure() && github.event_name != 'pull_request_target' }}
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: ./.github/actions/slack-alert
         if: ${{ failure() && github.event_name != 'pull_request_target' }}
         with:
diff --git a/.github/workflows/content-lint-markdown.yml b/.github/workflows/content-lint-markdown.yml
index f00366bc9ab8..d2f998bd9084 100644
--- a/.github/workflows/content-lint-markdown.yml
+++ b/.github/workflows/content-lint-markdown.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repo
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Set up Node and dependencies
         uses: ./.github/actions/node-npm-setup
diff --git a/.github/workflows/content-linter-rules-docs.yml b/.github/workflows/content-linter-rules-docs.yml
index 4d17f0cc2ae0..1f0c7ebe9d64 100644
--- a/.github/workflows/content-linter-rules-docs.yml
+++ b/.github/workflows/content-linter-rules-docs.yml
@@ -25,7 +25,7 @@ jobs:
     if: github.repository == 'github/docs-internal' || github.repository == 'github/docs'
     steps:
       - name: Checkout
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - uses: ./.github/actions/node-npm-setup
 
diff --git a/.github/workflows/copy-api-issue-to-internal.yml b/.github/workflows/copy-api-issue-to-internal.yml
index 4f52dd60d3ab..df1bf1a31fa9 100644
--- a/.github/workflows/copy-api-issue-to-internal.yml
+++ b/.github/workflows/copy-api-issue-to-internal.yml
@@ -73,7 +73,7 @@ jobs:
 
       - name: Check out repo
         if: ${{ failure() && github.event_name != 'workflow_dispatch' && github.repository == 'github/docs-internal' }}
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: ./.github/actions/slack-alert
         if: ${{ failure() && github.event_name != 'workflow_dispatch' && github.repository == 'github/docs-internal' }}
         with:
diff --git a/.github/workflows/count-translation-corruptions.yml b/.github/workflows/count-translation-corruptions.yml
index 0c8b901f0ee2..8045fcc713c9 100644
--- a/.github/workflows/count-translation-corruptions.yml
+++ b/.github/workflows/count-translation-corruptions.yml
@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout English repo
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           # Using a PAT is necessary so that the new commit will trigger the
           # CI in the PR. (Events from GITHUB_TOKEN don't trigger new workflows.)
diff --git a/.github/workflows/create-changelog-pr.yml b/.github/workflows/create-changelog-pr.yml
index 626af254771f..e4cc83aaf36a 100644
--- a/.github/workflows/create-changelog-pr.yml
+++ b/.github/workflows/create-changelog-pr.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6.0.0
+      - uses: actions/checkout@v6.0.1
 
       - name: 'Ensure ${{ env.CHANGELOG_FILE }} exists'
         run: |
diff --git a/.github/workflows/delete-orphan-translation-files.yml b/.github/workflows/delete-orphan-translation-files.yml
index d97fa24b30c5..ceadbc0b8bc9 100644
--- a/.github/workflows/delete-orphan-translation-files.yml
+++ b/.github/workflows/delete-orphan-translation-files.yml
@@ -60,10 +60,10 @@ jobs:
             language_repo: github/docs-internal.ko-kr
 
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Checkout the language-specific repo
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           repository: ${{ matrix.language_repo }}
           token: ${{ secrets.DOCS_BOT_PAT_BASE }}
diff --git a/.github/workflows/docs-review-collect.yml b/.github/workflows/docs-review-collect.yml
index f97bfbca4ae4..8e1bce8f7af9 100644
--- a/.github/workflows/docs-review-collect.yml
+++ b/.github/workflows/docs-review-collect.yml
@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Check out repo content
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Setup Node.js
         uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
diff --git a/.github/workflows/dont-delete-assets.yml b/.github/workflows/dont-delete-assets.yml
index 17ff82230cdb..3d66d1c6dc82 100644
--- a/.github/workflows/dont-delete-assets.yml
+++ b/.github/workflows/dont-delete-assets.yml
@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repo
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - uses: ./.github/actions/node-npm-setup
 
diff --git a/.github/workflows/dont-delete-features.yml b/.github/workflows/dont-delete-features.yml
index 16a0cea8f555..9790d399ed2a 100644
--- a/.github/workflows/dont-delete-features.yml
+++ b/.github/workflows/dont-delete-features.yml
@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repo
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - uses: ./.github/actions/node-npm-setup
 
diff --git a/.github/workflows/enterprise-dates.yml b/.github/workflows/enterprise-dates.yml
index 92dd93e20b36..bcf58810d2fc 100644
--- a/.github/workflows/enterprise-dates.yml
+++ b/.github/workflows/enterprise-dates.yml
@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository code
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - uses: ./.github/actions/node-npm-setup
 
diff --git a/.github/workflows/enterprise-release-issue.yml b/.github/workflows/enterprise-release-issue.yml
index eabaf5bf0f27..83ef2f61fe3e 100644
--- a/.github/workflows/enterprise-release-issue.yml
+++ b/.github/workflows/enterprise-release-issue.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository code
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - uses: ./.github/actions/node-npm-setup
 
diff --git a/.github/workflows/first-responder-v2-prs-collect.yml b/.github/workflows/first-responder-v2-prs-collect.yml
index 4ebc9dcbac6e..5428ca37c66a 100644
--- a/.github/workflows/first-responder-v2-prs-collect.yml
+++ b/.github/workflows/first-responder-v2-prs-collect.yml
@@ -24,7 +24,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.0
+        uses: actions/checkout@v6.0.1
 
       # Add to the FR project
       # and set type to "Maintenance"
diff --git a/.github/workflows/generate-code-scanning-query-lists.yml b/.github/workflows/generate-code-scanning-query-lists.yml
index 1da11640e0b0..72bcbae3d768 100644
--- a/.github/workflows/generate-code-scanning-query-lists.yml
+++ b/.github/workflows/generate-code-scanning-query-lists.yml
@@ -33,12 +33,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository code
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - uses: ./.github/actions/node-npm-setup
 
       - name: Checkout codeql repo
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           repository: github/codeql
           path: codeql
@@ -99,12 +99,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository code
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - uses: ./.github/actions/node-npm-setup
 
       - name: Checkout codeql repo
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           repository: github/codeql
           path: codeql
@@ -162,10 +162,10 @@ jobs:
     needs: [generate-security-query-lists, generate-quality-query-lists]
     steps:
       - name: Checkout repository code
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Checkout codeql repo
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           repository: github/codeql
           path: codeql
diff --git a/.github/workflows/headless-tests.yml b/.github/workflows/headless-tests.yml
index 535d6c036ec2..29d371a28203 100644
--- a/.github/workflows/headless-tests.yml
+++ b/.github/workflows/headless-tests.yml
@@ -37,7 +37,7 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Check out repo
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - uses: ./.github/actions/setup-elasticsearch
 
diff --git a/.github/workflows/hubber-contribution-help.yml b/.github/workflows/hubber-contribution-help.yml
index a105b8d3042b..aa0f3b6d0164 100644
--- a/.github/workflows/hubber-contribution-help.yml
+++ b/.github/workflows/hubber-contribution-help.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repo
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - id: membership_check
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
diff --git a/.github/workflows/index-autocomplete-search.yml b/.github/workflows/index-autocomplete-search.yml
index 408fecf43061..aa498f2b5f23 100644
--- a/.github/workflows/index-autocomplete-search.yml
+++ b/.github/workflows/index-autocomplete-search.yml
@@ -23,14 +23,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - uses: ./.github/actions/node-npm-setup
 
       - uses: ./.github/actions/setup-elasticsearch
         if: ${{ github.event_name == 'pull_request' }}
 
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           token: ${{ secrets.DOCS_BOT_PAT_BASE }}
           repository: github/docs-internal-data
diff --git a/.github/workflows/index-general-search-pr.yml b/.github/workflows/index-general-search-pr.yml
index dd1ebf27883d..3220a1e6e2d9 100644
--- a/.github/workflows/index-general-search-pr.yml
+++ b/.github/workflows/index-general-search-pr.yml
@@ -37,10 +37,10 @@ jobs:
     if: github.repository == 'github/docs-internal'
     steps:
       - name: Check out repo
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Clone docs-internal-data
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           repository: github/docs-internal-data
           # This works because user `docs-bot` has read access to that private repo.
diff --git a/.github/workflows/index-general-search.yml b/.github/workflows/index-general-search.yml
index 683833c81628..f09cb3aa8a55 100644
--- a/.github/workflows/index-general-search.yml
+++ b/.github/workflows/index-general-search.yml
@@ -87,7 +87,7 @@ jobs:
 
       - name: Check out repo
         if: ${{ failure() && github.event_name != 'workflow_dispatch' }}
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - uses: ./.github/actions/slack-alert
         if: ${{ failure() && github.event_name != 'workflow_dispatch' }}
@@ -115,10 +115,10 @@ jobs:
         language: ${{ fromJSON(needs.figureOutMatrix.outputs.matrix) }}
     steps:
       - name: Check out repo
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Clone docs-internal-data
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           repository: github/docs-internal-data
           # This works because user `docs-bot` has read access to that private repo.
diff --git a/.github/workflows/keep-caches-warm.yml b/.github/workflows/keep-caches-warm.yml
index e63de3ecd6b1..0cffbf8e205b 100644
--- a/.github/workflows/keep-caches-warm.yml
+++ b/.github/workflows/keep-caches-warm.yml
@@ -29,7 +29,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repo
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - uses: ./.github/actions/node-npm-setup
 
diff --git a/.github/workflows/link-check-daily.yml b/.github/workflows/link-check-daily.yml
index 63e8933ea4ff..b9469bd0b163 100644
--- a/.github/workflows/link-check-daily.yml
+++ b/.github/workflows/link-check-daily.yml
@@ -23,7 +23,7 @@ jobs:
         run: gh --version
 
       - name: Check out repo's default branch
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - uses: ./.github/actions/node-npm-setup
 
@@ -37,7 +37,7 @@ jobs:
 
       - name: Check out docs-early-access too, if internal repo
         if: ${{ github.repository == 'github/docs-internal' }}
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           repository: github/docs-early-access
           token: ${{ secrets.DOCS_BOT_PAT_BASE }}
@@ -49,7 +49,7 @@ jobs:
         run: src/early-access/scripts/merge-early-access.sh
 
       - name: Restore disk-cache file for external link checking
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: external-link-checker-db.json
           key: external-link-checker-${{ hashFiles('src/links/scripts/rendered-content-link-checker.ts') }}
diff --git a/.github/workflows/link-check-on-pr.yml b/.github/workflows/link-check-on-pr.yml
index 811c47752f3d..484bc4c17b43 100644
--- a/.github/workflows/link-check-on-pr.yml
+++ b/.github/workflows/link-check-on-pr.yml
@@ -26,7 +26,7 @@ jobs:
     if: github.repository == 'github/docs-internal' || github.repository == 'github/docs'
     steps:
       - name: Checkout
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - uses: ./.github/actions/node-npm-setup
 
diff --git a/.github/workflows/lint-code.yml b/.github/workflows/lint-code.yml
index da2094ec5a42..e64b584d4e66 100644
--- a/.github/workflows/lint-code.yml
+++ b/.github/workflows/lint-code.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repo
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - uses: ./.github/actions/node-npm-setup
 
diff --git a/.github/workflows/lint-entire-content-data-markdown.yml b/.github/workflows/lint-entire-content-data-markdown.yml
index d59a2b89a75d..12208a455150 100644
--- a/.github/workflows/lint-entire-content-data-markdown.yml
+++ b/.github/workflows/lint-entire-content-data-markdown.yml
@@ -23,7 +23,7 @@ jobs:
         run: gh --version
 
       - name: Check out repo's default branch
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Set up Node and dependencies
         uses: ./.github/actions/node-npm-setup
diff --git a/.github/workflows/local-dev.yml b/.github/workflows/local-dev.yml
index 8e69474ed211..fc0ff3bef23b 100644
--- a/.github/workflows/local-dev.yml
+++ b/.github/workflows/local-dev.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repo
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - uses: ./.github/actions/node-npm-setup
 
diff --git a/.github/workflows/moda-allowed-ips.yml b/.github/workflows/moda-allowed-ips.yml
index c188dbd56935..fc484cb224f7 100644
--- a/.github/workflows/moda-allowed-ips.yml
+++ b/.github/workflows/moda-allowed-ips.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v6.0.0
+        uses: actions/checkout@v6.0.1
 
       - name: Update list of allowed IPs
         run: |
diff --git a/.github/workflows/move-content.yml b/.github/workflows/move-content.yml
index 9df8f84e9a64..9e85604d7600 100644
--- a/.github/workflows/move-content.yml
+++ b/.github/workflows/move-content.yml
@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repo
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - uses: ./.github/actions/node-npm-setup
 
diff --git a/.github/workflows/move-ready-to-merge-pr.yaml b/.github/workflows/move-ready-to-merge-pr.yaml
index 8c9b4df87330..590e1580766d 100644
--- a/.github/workflows/move-ready-to-merge-pr.yaml
+++ b/.github/workflows/move-ready-to-merge-pr.yaml
@@ -31,7 +31,7 @@ jobs:
           repo-token: ${{ secrets.DOCS_BOT_PAT_BASE }}
 
       - name: Check out repo
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - uses: ./.github/actions/node-npm-setup
 
diff --git a/.github/workflows/move-reopened-issues-to-triage.yaml b/.github/workflows/move-reopened-issues-to-triage.yaml
index 80726a5c10c8..e14ea8d31f8c 100644
--- a/.github/workflows/move-reopened-issues-to-triage.yaml
+++ b/.github/workflows/move-reopened-issues-to-triage.yaml
@@ -45,7 +45,7 @@ jobs:
 
       - name: Check out repo
         if: ${{ failure() }}
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: ./.github/actions/slack-alert
         if: ${{ failure() }}
         with:
diff --git a/.github/workflows/needs-sme-stale-check.yaml b/.github/workflows/needs-sme-stale-check.yaml
index a847c4997d63..baa55711cf19 100644
--- a/.github/workflows/needs-sme-stale-check.yaml
+++ b/.github/workflows/needs-sme-stale-check.yaml
@@ -35,7 +35,7 @@ jobs:
 
       - name: Check out repo
         if: ${{ failure() }}
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: ./.github/actions/slack-alert
         if: ${{ failure() }}
         with:
diff --git a/.github/workflows/needs-sme-workflow.yml b/.github/workflows/needs-sme-workflow.yml
index 1d3b6bef881b..82a9d32c1ecb 100644
--- a/.github/workflows/needs-sme-workflow.yml
+++ b/.github/workflows/needs-sme-workflow.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repo
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9
         with:
@@ -41,7 +41,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repo
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9
         with:
diff --git a/.github/workflows/no-response.yaml b/.github/workflows/no-response.yaml
index 11c7bccf3665..5cfc94688018 100644
--- a/.github/workflows/no-response.yaml
+++ b/.github/workflows/no-response.yaml
@@ -57,7 +57,7 @@ jobs:
 
       - name: Check out repo
         if: ${{ failure() }}
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: ./.github/actions/slack-alert
         if: ${{ failure() }}
         with:
diff --git a/.github/workflows/notify-about-deployment.yml b/.github/workflows/notify-about-deployment.yml
index dfefe3de87fb..30f8443978ed 100644
--- a/.github/workflows/notify-about-deployment.yml
+++ b/.github/workflows/notify-about-deployment.yml
@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repo
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - uses: ./.github/actions/node-npm-setup
 
diff --git a/.github/workflows/orphaned-features-check.yml b/.github/workflows/orphaned-features-check.yml
index c499e1e38fd1..d3ec2d401f20 100644
--- a/.github/workflows/orphaned-features-check.yml
+++ b/.github/workflows/orphaned-features-check.yml
@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout English repo
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           # Using a PAT is necessary so that the new commit will trigger the
           # CI in the PR. (Events from GITHUB_TOKEN don't trigger new workflows.)
diff --git a/.github/workflows/orphaned-files-check.yml b/.github/workflows/orphaned-files-check.yml
index db410c1b5bf3..d425621ac707 100644
--- a/.github/workflows/orphaned-files-check.yml
+++ b/.github/workflows/orphaned-files-check.yml
@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout English repo
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           # Using a PAT is necessary so that the new commit will trigger the
           # CI in the PR. (Events from GITHUB_TOKEN don't trigger new workflows.)
diff --git a/.github/workflows/os-ready-for-review.yml b/.github/workflows/os-ready-for-review.yml
index 7aef9268f45c..282dd07278dd 100644
--- a/.github/workflows/os-ready-for-review.yml
+++ b/.github/workflows/os-ready-for-review.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repo content
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Check if this run was triggered by a member of the docs team
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
diff --git a/.github/workflows/package-lock-lint.yml b/.github/workflows/package-lock-lint.yml
index 105d074170ee..dcc3ffa41f9c 100644
--- a/.github/workflows/package-lock-lint.yml
+++ b/.github/workflows/package-lock-lint.yml
@@ -25,7 +25,7 @@ jobs:
     if: github.repository == 'github/docs-internal' || github.repository == 'github/docs'
     steps:
       - name: Check out repo
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Setup Node.js
         uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
diff --git a/.github/workflows/purge-fastly.yml b/.github/workflows/purge-fastly.yml
index ad0eae2a4bf6..eaccdfba31df 100644
--- a/.github/workflows/purge-fastly.yml
+++ b/.github/workflows/purge-fastly.yml
@@ -32,7 +32,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repo
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - uses: ./.github/actions/node-npm-setup
 
diff --git a/.github/workflows/readability.yml b/.github/workflows/readability.yml
index d2dddce67747..5bd3e7210623 100644
--- a/.github/workflows/readability.yml
+++ b/.github/workflows/readability.yml
@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repo with full history
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/ready-for-doc-review.yml b/.github/workflows/ready-for-doc-review.yml
index b34ef6a5aab5..6117465f2a77 100644
--- a/.github/workflows/ready-for-doc-review.yml
+++ b/.github/workflows/ready-for-doc-review.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repo content
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           repository: github/docs-internal
           token: ${{ secrets.DOCS_BOT_PAT_BASE }}
diff --git a/.github/workflows/repo-sync.yml b/.github/workflows/repo-sync.yml
index b6660f12d0a5..197af81bf964 100644
--- a/.github/workflows/repo-sync.yml
+++ b/.github/workflows/repo-sync.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repo
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/review-comment.yml b/.github/workflows/review-comment.yml
index e048d59b9ec3..6182eb3816af 100644
--- a/.github/workflows/review-comment.yml
+++ b/.github/workflows/review-comment.yml
@@ -38,7 +38,7 @@ jobs:
       PR_NUMBER: ${{ github.event.pull_request.number }}
     steps:
       - name: check out repo content
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: ./.github/actions/node-npm-setup
 
       - name: Set APP_URL
diff --git a/.github/workflows/reviewers-content-systems.yml b/.github/workflows/reviewers-content-systems.yml
index 654707564b44..705474c28cd1 100644
--- a/.github/workflows/reviewers-content-systems.yml
+++ b/.github/workflows/reviewers-content-systems.yml
@@ -36,7 +36,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.0
+        uses: actions/checkout@v6.0.1
 
       - name: Add content systems as a reviewer
         uses: ./.github/actions/retry-command
diff --git a/.github/workflows/reviewers-dependabot.yml b/.github/workflows/reviewers-dependabot.yml
index d02144dafffa..12a97b8e13c3 100644
--- a/.github/workflows/reviewers-dependabot.yml
+++ b/.github/workflows/reviewers-dependabot.yml
@@ -37,7 +37,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.0
+        uses: actions/checkout@v6.0.1
 
       - name: Add dependabot as a reviewer
         uses: ./.github/actions/retry-command
diff --git a/.github/workflows/reviewers-docs-engineering.yml b/.github/workflows/reviewers-docs-engineering.yml
index f6bdbb269d45..44b2ef8d4c7d 100644
--- a/.github/workflows/reviewers-docs-engineering.yml
+++ b/.github/workflows/reviewers-docs-engineering.yml
@@ -47,7 +47,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.0
+        uses: actions/checkout@v6.0.1
 
       - name: Add docs engineering as a reviewer
         uses: ./.github/actions/retry-command
diff --git a/.github/workflows/reviewers-legal.yml b/.github/workflows/reviewers-legal.yml
index 59ad01a5cd85..289e620d30cc 100644
--- a/.github/workflows/reviewers-legal.yml
+++ b/.github/workflows/reviewers-legal.yml
@@ -32,7 +32,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.0
+        uses: actions/checkout@v6.0.1
 
       - name: Get changed files
         id: changed_files
diff --git a/.github/workflows/site-policy-sync.yml b/.github/workflows/site-policy-sync.yml
index cc2e24c2f7fc..a6d999810e6d 100644
--- a/.github/workflows/site-policy-sync.yml
+++ b/.github/workflows/site-policy-sync.yml
@@ -27,10 +27,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: checkout docs-internal
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: checkout public site-policy
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           repository: github/site-policy
           token: ${{ secrets.API_TOKEN_SITEPOLICY }}
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index f3ac4f2fecbc..752ad73513f1 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -38,7 +38,7 @@ jobs:
 
       - name: Check out repo
         if: ${{ failure() }}
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: ./.github/actions/slack-alert
         if: ${{ failure() }}
         with:
diff --git a/.github/workflows/sync-audit-logs.yml b/.github/workflows/sync-audit-logs.yml
index d49b5d649a3e..66da9494d5e3 100644
--- a/.github/workflows/sync-audit-logs.yml
+++ b/.github/workflows/sync-audit-logs.yml
@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - uses: ./.github/actions/node-npm-setup
 
diff --git a/.github/workflows/sync-codeql-cli.yml b/.github/workflows/sync-codeql-cli.yml
index b68c6617f5e3..d5f7bf45e842 100644
--- a/.github/workflows/sync-codeql-cli.yml
+++ b/.github/workflows/sync-codeql-cli.yml
@@ -30,11 +30,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository code
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
         # Check out a nested repository inside of previous checkout
       - name: Checkout semmle-code repo
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           # By default, only the most recent commit of the `main` branch
           # will be checked out
diff --git a/.github/workflows/sync-graphql.yml b/.github/workflows/sync-graphql.yml
index 39d7e6454c3e..c1c763395c87 100644
--- a/.github/workflows/sync-graphql.yml
+++ b/.github/workflows/sync-graphql.yml
@@ -23,7 +23,7 @@ jobs:
       ignored-types: ${{ steps.sync.outputs.ignored-types }}
     steps:
       - name: Checkout
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: ./.github/actions/node-npm-setup
       - name: Run updater scripts
         id: sync
@@ -82,7 +82,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: ./.github/actions/slack-alert
         with:
           slack_channel_id: ${{ secrets.DOCS_ALERTS_SLACK_CHANNEL_ID }}
diff --git a/.github/workflows/sync-openapi.yml b/.github/workflows/sync-openapi.yml
index e2474d481d06..3093ff511714 100644
--- a/.github/workflows/sync-openapi.yml
+++ b/.github/workflows/sync-openapi.yml
@@ -30,11 +30,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository code
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
         # Check out a nested repository inside of previous checkout
       - name: Checkout rest-api-description repo
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           # By default, only the most recent commit of the `main` branch
           # will be checked out
@@ -42,7 +42,7 @@ jobs:
           path: rest-api-description
           ref: ${{ inputs.SOURCE_BRANCH }}
 
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           # By default, only the most recent commit of the `main` branch
           # will be checked out
diff --git a/.github/workflows/sync-secret-scanning.yml b/.github/workflows/sync-secret-scanning.yml
index e83f1d5d9574..53e5b9a9dd73 100644
--- a/.github/workflows/sync-secret-scanning.yml
+++ b/.github/workflows/sync-secret-scanning.yml
@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - uses: ./.github/actions/node-npm-setup
 
diff --git a/.github/workflows/test-changed-content.yml b/.github/workflows/test-changed-content.yml
index 9581106ca735..23a0a9e2b0ad 100644
--- a/.github/workflows/test-changed-content.yml
+++ b/.github/workflows/test-changed-content.yml
@@ -27,7 +27,7 @@ jobs:
       # Each of these ifs needs to be repeated at each step to make sure the required check still runs
       # Even if if doesn't do anything
       - name: Check out repo
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - uses: ./.github/actions/node-npm-setup
 
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 238b7dd1fab6..2815b0d847e9 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -87,7 +87,7 @@ jobs:
       # Each of these ifs needs to be repeated at each step to make sure the required check still runs
       # Even if if doesn't do anything
       - name: Check out repo
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - uses: ./.github/actions/setup-elasticsearch
         if: ${{ matrix.name == 'search' || matrix.name == 'languages' }}
diff --git a/.github/workflows/triage-issue-comments.yml b/.github/workflows/triage-issue-comments.yml
index 6b96d0f48f5f..f9bfc823db93 100644
--- a/.github/workflows/triage-issue-comments.yml
+++ b/.github/workflows/triage-issue-comments.yml
@@ -43,7 +43,7 @@ jobs:
             }
 
       - name: Check out repo
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - uses: ./.github/actions/node-npm-setup
 
diff --git a/.github/workflows/triage-issues.yml b/.github/workflows/triage-issues.yml
index 4b5d1080c882..e48f13d7e7a4 100644
--- a/.github/workflows/triage-issues.yml
+++ b/.github/workflows/triage-issues.yml
@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Check out repo
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - uses: ./.github/actions/node-npm-setup
 
diff --git a/.github/workflows/triage-pull-requests.yml b/.github/workflows/triage-pull-requests.yml
index 463d08a4e37e..002da127dd66 100644
--- a/.github/workflows/triage-pull-requests.yml
+++ b/.github/workflows/triage-pull-requests.yml
@@ -23,7 +23,7 @@ jobs:
 
     steps:
       - name: Check out repo
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - uses: ./.github/actions/node-npm-setup
 
diff --git a/.github/workflows/triage-stale-check.yml b/.github/workflows/triage-stale-check.yml
index c88030bc174a..175e5d3e389a 100644
--- a/.github/workflows/triage-stale-check.yml
+++ b/.github/workflows/triage-stale-check.yml
@@ -44,7 +44,7 @@ jobs:
 
       - name: Check out repo
         if: ${{ failure() }}
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: ./.github/actions/slack-alert
         if: ${{ failure() }}
         with:
@@ -72,7 +72,7 @@ jobs:
 
       - name: Check out repo
         if: ${{ failure() }}
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: ./.github/actions/slack-alert
         if: ${{ failure() }}
         with:
diff --git a/.github/workflows/triage-unallowed-contributions.yml b/.github/workflows/triage-unallowed-contributions.yml
index c3fea077d274..802d2d8f138b 100644
--- a/.github/workflows/triage-unallowed-contributions.yml
+++ b/.github/workflows/triage-unallowed-contributions.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repo
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Get files changed
         uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd
diff --git a/.github/workflows/validate-asset-images.yml b/.github/workflows/validate-asset-images.yml
index b3eef046db31..23effc21b63d 100644
--- a/.github/workflows/validate-asset-images.yml
+++ b/.github/workflows/validate-asset-images.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repo
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - uses: ./.github/actions/node-npm-setup
 
diff --git a/.github/workflows/validate-github-github-docs-urls.yml b/.github/workflows/validate-github-github-docs-urls.yml
index 488f795dbf45..cb76eb5e73c0 100644
--- a/.github/workflows/validate-github-github-docs-urls.yml
+++ b/.github/workflows/validate-github-github-docs-urls.yml
@@ -34,10 +34,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repo's default branch
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: ./.github/actions/node-npm-setup
 
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           token: ${{ secrets.DOCS_BOT_PAT_BASE }}
           repository: github/github
diff --git a/.github/workflows/validate-openapi-check.yml b/.github/workflows/validate-openapi-check.yml
index 93e3460acd73..96f59c7b8ad0 100644
--- a/.github/workflows/validate-openapi-check.yml
+++ b/.github/workflows/validate-openapi-check.yml
@@ -28,7 +28,7 @@ jobs:
     if: github.repository == 'github/docs-internal'
     steps:
       - name: Checkout
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1
diff --git a/content/code-security/secret-scanning/introduction/supported-secret-scanning-patterns.md b/content/code-security/secret-scanning/introduction/supported-secret-scanning-patterns.md
index 0f74e6878078..802e62d407ac 100644
--- a/content/code-security/secret-scanning/introduction/supported-secret-scanning-patterns.md
+++ b/content/code-security/secret-scanning/introduction/supported-secret-scanning-patterns.md
@@ -31,7 +31,7 @@ If you believe that {% data variables.product.prodname_secret_scanning %} should
 
 ## Supported secrets
 
-This table lists the secrets supported by {% data variables.product.prodname_secret_scanning %}. You can see the types of alert that get generated for each token, as well as whether a validity check is performed on the token.
+The tables list the secrets supported by {% data variables.product.prodname_secret_scanning %} for each secret type. Information in the tables may include this data:
 
 * **Provider:** Name of the token provider.{% ifversion fpt or ghec %}
 * **Partner:** Token for which leaks are reported to the relevant token partner. Applies to public repositories and all gists, including secret gists. Secret gists are not private and can be accessed by anyone with the URL. See [About gists](/get-started/writing-on-github/editing-and-sharing-content-with-gists/creating-gists#about-gists).
@@ -44,8 +44,8 @@ This table lists the secrets supported by {% data variables.product.prodname_sec
   * Applies to private repositories where {% data variables.product.prodname_GH_secret_protection %} and {% data variables.product.prodname_secret_scanning %} are enabled.
   * Includes {% ifversion secret-scanning-alert-experimental-list %}default{% else %}high confidence{% endif %} tokens, which relate to supported patterns and specified custom patterns, as well as non-provider tokens such as private keys, which often result in false positives.{% endif %}
 * **Push protection:** Token for which leaks are reported to users on {% data variables.product.prodname_dotcom %}. Applies to repositories with {% data variables.product.prodname_secret_scanning %} and push protection enabled.
-
 * **Validity check:** Token for which a validity check is implemented. {% ifversion secret-scanning-validity-check-partner-patterns %}For partner tokens, {% data variables.product.prodname_dotcom %} sends the token to the relevant partner. Note that not all partners are based in the United States. For more information, see [{% data variables.product.prodname_AS %}](/free-pro-team@latest/site-policy/github-terms/github-terms-for-additional-products-and-features#advanced-security) in the Site Policy documentation.{% else %} Currently only applies to {% data variables.product.prodname_dotcom %} tokens.{% endif %}
+* **Base64:** Token for which Base64-encoded versions are supported.
 
 ### Non-provider patterns
 
diff --git a/data/reusables/enterprise_installation/replication-command.md b/data/reusables/enterprise_installation/replication-command.md
index ef876aa65290..853d84ffaa25 100644
--- a/data/reusables/enterprise_installation/replication-command.md
+++ b/data/reusables/enterprise_installation/replication-command.md
@@ -6,3 +6,4 @@
 
    > [!WARNING]
    > `ghe-repl-start` causes a brief outage on the primary server, during which users may see internal server errors. To provide a friendlier message, run `ghe-maintenance -s` on the primary node before running `ghe-repl-start` on the replica node to put the appliance in maintenance mode. Once replication starts, disable maintenance mode with `ghe-maintenance -u`. Git replication will not progress while the primary node is in maintenance mode.
+   > If you are running version 3.14.20, 3.15.15, 3.16.11, 3.17.8, 3.18.2, or a later version including future releases like 3.19, you no longer need to put the primary in maintenance mode prior to running `ghe-repl-start`. This command is no longer expected to cause an outage on the primary server. However, when setting up a new replica, `ghe-repl-start` won't cause an outage as long as you run `ghe-config-apply` between `ghe-repl-setup` and `ghe-repl-start`. Skipping `ghe-config-apply` and going straight from `ghe-repl-setup` to `ghe-repl-start` will still result in an outage.
diff --git a/src/archives/README.md b/src/archives/README.md
index 8aeee1670109..98f3f3148125 100644
--- a/src/archives/README.md
+++ b/src/archives/README.md
@@ -1,5 +1,86 @@
 # Archives
 
-Product oriented code to handle archived versions of the Docs, such as archived Enterprise Server versions.
+This directory contains the infrastructure for serving archived versions of GitHub Docs, primarily for deprecated GitHub Enterprise Server (GHES) releases.
 
-The directory `versions/` handles non-archived versions of the docs. `ghes-releases/` handles version releases and deprecations processes.
+## Purpose & Scope
+
+To keep the main documentation site fast and the build lightweight, we do not build deprecated GHES versions from source. Instead, we serve them as static snapshots. This directory provides the middleware that:
+
+1.  **Detects** requests for archived versions.
+2.  **Proxies** the HTML and assets from their static hosting location.
+3.  **Rewrites** content on-the-fly to ensure links and assets work correctly within the current site structure.
+
+## Architecture
+
+The system acts as a reverse proxy for specific URL paths.
+
+### Directory Structure
+
+- **`middleware/`**
+  - `archived-enterprise-versions.ts`: The primary handler. It:
+    - Checks if a URL belongs to a deprecated version.
+    - Fetches the content from the external host.
+    - Rewrites HTML (e.g., fixing image paths, injecting new headers).
+    - Handles redirects defined in the archived version's `redirects.json`.
+  - `archived-enterprise-versions-assets.ts`: Proxies static assets (CSS, JS, fonts) from the archive host.
+  - `archived-asset-redirects.ts`: Maps legacy asset paths to modern equivalents where possible.
+- **`lib/`**
+  - `is-archived-version.ts`: Utilities to parse URLs and check against the list of deprecated versions defined in `src/versions`.
+- **`scripts/`**
+  - `warmup-remotejson.ts`: Utility to prime caches for remote JSON files.
+
+### Request Flow
+
+```mermaid
+graph TD
+    A[Incoming Request] --> B{Is Archived Version?}
+    B -- No --> C[Next Middleware]
+    B -- Yes --> D{Is Asset?}
+    D -- Yes --> E[archived-enterprise-versions-assets]
+    D -- No --> F[archived-enterprise-versions]
+    E --> G[Fetch from docs-ghes-X.X repo]
+    F --> H[Fetch HTML from docs-ghes-X.X repo]
+    H --> I[Rewrite Body & Headers]
+    I --> J[Serve Response]
+    G --> J
+```
+
+## Data & External Dependencies
+
+### External Hosting
+Archived versions are hosted as static sites on GitHub Pages, typically in repositories named `github/docs-ghes-<version>`.
+- **Source**: `https://github.github.com/docs-ghes-<version>`
+- **Content**: These repos contain the fully built static HTML and assets for that version at the time of its deprecation.
+
+### Internal Dependencies
+- **`src/versions`**: The `deprecated` array in `src/versions/lib/enterprise-server-releases.ts` is the source of truth for which versions are handled by this middleware.
+- **`src/frame`**: Uses shared patterns and fetch utilities.
+
+## Setup & Usage
+
+This functionality is enabled by default in the application.
+
+### Local Development
+To test archived versions locally:
+1. Ensure you have internet access (the middleware fetches from public URLs).
+2. Navigate to a deprecated version URL, e.g., `http://localhost:4000/enterprise-server@3.0`.
+
+### Adding a New Archive
+When a GHES version is deprecated:
+1. A static snapshot is created and pushed to a `docs-ghes-<version>` repository.
+2. The version is moved to the `deprecated` list in `src/versions/lib/enterprise-server-releases.ts`.
+3. This middleware automatically starts handling requests for that version.
+
+## Ownership & Cross-links
+
+- **Owner**: Docs Engineering
+- **Related Code**:
+  - `src/versions`: Version configuration.
+  - `src/ghes-releases`: Release lifecycle management.
+
+## Current State & Next Steps
+
+- **Health**: The system is stable (KTLO) but relies on the availability of the external GitHub Pages sites. A new version is deprecated and added to this system approximately once per quarter.
+- **Known Issues**:
+  - "Flash of content" or layout shifts can occur if CSS proxies are slow.
+  - Search is generally disabled or limited for archived versions.
diff --git a/src/audit-logs/README.md b/src/audit-logs/README.md
index b9320daa1d42..e30b51c3e2b6 100644
--- a/src/audit-logs/README.md
+++ b/src/audit-logs/README.md
@@ -69,3 +69,26 @@ Slack: `#docs-engineering`
 Repo: `github/docs-engineering`
 
 If you have a question about the audit log events pipeline, you can ask in the `#docs-engineering` Slack channel. If you notice a problem with the audit log events pipeline, you can open an issue in the `github/docs-engineering` repository.
+
+## Ownership & On-call
+
+### Ownership
+- **Team**: Docs Engineering
+- **Source data**: github/audit-log-allowlists
+
+### On-call procedures
+If the audit log pipeline fails:
+1. Check workflow logs in `.github/workflows/sync-audit-logs.yml`
+2. Verify access to `github/audit-log-allowlists` repo
+3. Check for schema changes in source data
+4. Escalate to #docs-engineering if stuck
+
+### Monitoring
+- Daily workflow runs automatically
+- PRs created with `audit-log-pipeline` label when updates detected
+- Failures visible in GitHub Actions
+
+We are not expecting significant investment here. We will support updates to audit log data as we receive them.
+- Automate version detection
+- Add event usage analytics
+- Create event category visualizations
diff --git a/src/journeys/README.md b/src/journeys/README.md
new file mode 100644
index 000000000000..62b78f5bc72d
--- /dev/null
+++ b/src/journeys/README.md
@@ -0,0 +1,87 @@
+# Journeys
+
+The **journeys** subject provides guided learning experiences (called "tracks") that help users navigate through a sequence of related documentation articles. Tracks appear on special landing pages and provide contextual navigation to move through articles in a structured learning path.
+
+## Purpose & Scope
+
+This subject is responsible for:
+- Rendering journey landing pages that display multiple learning tracks
+- Providing prev/next navigation within journey track articles
+- Resolving journey context based on the current article path
+- Rendering Liquid templates in journey metadata (titles, descriptions, guide paths)
+
+Journey tracks are defined in article frontmatter using the `journeyTracks` field on pages with `layout: journey-landing`.
+
+## Architecture & Key Assets
+
+```
+src/journeys/
+├── components/
+│   ├── JourneyTrackCard.tsx    # Card showing journey progress with next/prev links
+│   ├── JourneyTrackNav.tsx     # Navigation bar for prev/next articles in a track
+│   └── index.ts                # Component exports
+├── lib/
+│   ├── get-link-data.ts        # Fetches title and href data for journey guide links
+│   └── journey-path-resolver.ts # Core logic: resolves journey context and tracks
+├── middleware/
+│   └── journey-track.ts        # Express middleware that attaches journey data to requests
+└── tests/
+    └── journey-path-resolver.ts # Unit tests for journey resolution logic
+```
+
+
+
+## Setup & Usage
+
+### Prerequisites
+- Journey landing pages must have `layout: journey-landing` in their frontmatter
+- Journey tracks are defined in the `journeyTracks` frontmatter field (see example below)
+
+### Running tests
+```bash
+npm run test -- src/journeys/tests
+```
+
+### Example frontmatter for journey landing page
+```yaml
+---
+title: Enterprise onboarding
+layout: journey-landing
+journeyTracks:
+  - id: 'getting_started'
+    title: 'Getting started with {% data variables.product.prodname_ghe_cloud %}'
+    description: 'Master the fundamentals and get started with a trial.'
+    guides:
+      - '/enterprise-onboarding/choose-an-enterprise-type'
+      - '/enterprise-onboarding/setting-up-a-trial'
+      - '/enterprise-onboarding/adding-users'
+---
+```
+
+## Data & External Dependencies
+
+### Data inputs
+- **Content frontmatter**: `journeyTracks` field on landing pages defines track structure
+- **Article metadata**: Article titles and paths are resolved via `get-link-data.ts`
+- **Liquid variables**: Track titles, descriptions, and guide paths support Liquid templating
+
+### Dependencies
+- **`@/content-render`**: Used to render Liquid templates in journey metadata
+- **`@/frame/lib/path-utils`**: Normalizes paths for consistent matching
+- **`@/versions`**: Checks version compatibility between journey pages and articles
+- **`@/languages`**: Executes rendering with fallback for internationalization
+- **`@/landings`**: Journey components are consumed by landing page layouts
+
+### Data outputs
+- **`req.context.currentJourneyTrack`**: Journey context object with track info and prev/next links
+- **`req.context.page.resolvedJourneyTracks`**: Array of resolved track data for landing pages
+
+## Current State & Next Steps
+
+### Known limitations
+- Journey tracks currently inherit version constraints from their landing page
+- Path normalization logic must stay synchronized with other path-handling middleware
+- Journey context resolution has some performance overhead due to iterating all pages
+- Currently only support a particular page belonging to a single journey track/step - we won't show nav components for all the journeys an article belongs to
+
+Continued work to expand and add more journey tracks.
diff --git a/src/landings/README.md b/src/landings/README.md
index 10dcc60de7d6..29e5d4053fe0 100644
--- a/src/landings/README.md
+++ b/src/landings/README.md
@@ -1,7 +1,65 @@
 # Landing pages
 
-Landing pages include the Docs home page, the product landing pages, and product guides pages.
+The landings subject provides components and logic for rendering various types of landing pages across docs.github.com, including the Docs home page, product landing pages, product guides pages, category pages, and specialized layouts like journey and discovery landings.
 
-## What landing pages are for
+## Purpose & Scope
 
-Landing pages provide a hierarchical view of their area, making navigating the Docs easier.
+This subject is responsible for:
+- Rendering different landing page layouts (product, guides, category, journey, discovery, bespoke)
+- Building and displaying featured links, article cards, and guide cards
+- Managing landing page context and data requirements
+- Providing hierarchical navigation for products and categories
+- Displaying article carousels and product releases
+
+Landing pages serve as navigational hubs that provide a hierarchical view of their area, making it easier to find and discover documentation.
+
+## Architecture & Key Assets
+
+| Landing Page Type | Layout Value | Purpose |
+|-------------------|--------------|---------|
+| Product landing | `product-landing` | Product overview pages with featured links and release notes |
+| Product guides | `product-guides` | Product guides listing organized by categories |
+| Category landing | `category-landing` | Category pages with hierarchical navigation |
+| Table of contents | `toc-landing` | Table of contents pages |
+| Journey landing | `journey-landing` | Guided learning journey pages with track navigation |
+| Discovery landing | `discovery-landing` | Discovery/exploration pages |
+| Home page | (special) | Docs.github.com homepage |
+
+## Setup & Usage
+
+### Running tests
+
+```bash
+npm run test -- src/landings/tests
+```
+
+## Data & External Dependencies
+
+### Data inputs
+- Page frontmatter: `layout`, `featuredLinks`, `journeyTracks`, etc.
+- Content tree: Used to build TOC and navigation hierarchies
+- Product metadata: Product names, versions, release information
+
+### Dependencies
+- [`@/frame`](../frame/README.md) - Context object, page data, shared components
+- [`@/content-render`](../content-render/README.md) - Renders Liquid in featured link titles
+- [`@/learning-track`](../learning-track/README.md) - Learning track data resolution
+- [`@/journeys`](../journeys/README.md) - Journey track components and data
+- [`@/products`](../products/README.md) - Product metadata and groupings
+- [`@/versions`](../versions/README.md) - Version-aware content filtering
+
+### Data outputs
+- `req.context.featuredLinks` - Resolved featured link data
+- Landing page contexts - Various context objects passed to React components
+- Rendered landing pages - Final HTML output
+
+## Current State & Next Steps
+
+### Known limitations
+- Multiple similar but distinct landing components (could be consolidated)
+- Featured links limited to 4 per category to avoid overly tall columns
+- Bespoke landing pages require custom components rather than data-driven approach
+
+### Areas for improvement
+- Standardize landing page patterns and consolidate overlapping types
+- Make landing pages more data-driven and less code-heavy
\ No newline at end of file
diff --git a/src/tools/README.md b/src/tools/README.md
index 6a9141b1aa63..b7173e57b1bb 100644
--- a/src/tools/README.md
+++ b/src/tools/README.md
@@ -1,3 +1,72 @@
-# Tools
+# Tools & Platforms
 
-Tools are options for viewing content by development tool (web UI, CLI, etc) or by operating system (Linux, Mac, Windows).
+This module manages the "Tool Picker" and "Platform Picker" features, which allow users to toggle content based on their preferred environment (e.g., "GitHub CLI" vs. "Web UI") or operating system (e.g., "macOS" vs. "Windows").
+
+## Purpose & Scope
+
+The primary goal is to provide a personalized reading experience by:
+- **Filtering Content**: Showing only the instructions relevant to the user's selected tool or OS.
+- **Persisting Preferences**: Remembering the user's choice across the site.
+- **Analytics**: Tracking which tools are most popular to inform content strategy.
+
+## Architecture
+
+### Data Definitions (`src/tools/lib`)
+
+The available options are defined in static configuration files:
+- **`all-tools.ts`**: Maps internal IDs (e.g., `cli`, `webui`) to display names. The order of keys in this file determines the display order in the UI, often sorted by usage analytics.
+- **`all-platforms.ts`**: Defines operating systems (Mac, Windows, Linux).
+
+### Components (`src/tools/components`)
+
+The UI is built with React components that interact with the global application state:
+- **`ToolPicker.tsx`**: The dropdown or tab interface for selecting a tool.
+- **`PlatformPicker.tsx`**: The interface for selecting an operating system.
+- **`InArticlePicker.tsx`**: A specialized picker that appears within the article body (often used for "Prerequisites" sections).
+
+### State Management
+
+When a user selects a tool, the application:
+1.  Updates the local React state.
+2.  Persists the choice via cookies so it applies to future page loads.
+3.  Emits a tracking event (`docs_v0_preference_event`) to log the usage.
+
+## Setup & Usage
+
+### Adding a New Tool
+
+1.  Open `src/tools/lib/all-tools.ts`.
+2.  Add a new key-value pair to the `allTools` object:
+    ```typescript
+    export const allTools: ToolsMapping = {
+      // ... existing tools
+      my_new_tool: 'My New Tool',
+    }
+    ```
+3.  Ensure the content uses the corresponding Liquid tag or Markdown tab syntax to conditionally render content for `my_new_tool`.
+
+### Using the Picker in Content
+
+Content authors use specific Markdown/Liquid structures to create tabbed interfaces. The `ToolPicker` component automatically detects these structures and renders the appropriate UI.
+
+## Scripts
+
+### `liquid-markdown-tables`
+
+Located in `src/tools/scripts/liquid-markdown-tables`, this CLI tool helps refactor Markdown tables that use Liquid `ifversion` tags. It converts legacy/broken table syntax into a format that renders correctly.
+
+**Usage:**
+```bash
+npm run liquid-markdown-tables -- convert content/path/to/article.md
+```
+
+## Ownership
+
+- **Team**: `@github/docs-engineering`
+- **Content Strategy**: The list of supported tools is maintained in collaboration with the Content team based on product requirements.
+
+## Current State & Next Steps
+
+- **Current State**: The tools and platforms picker module is stable and actively maintained. Core features are complete and in regular use across the site.
+- **Known Limitations**: Some legacy articles may not fully support picker functionality due to outdated Markdown or Liquid structures. Analytics integration is basic and may be expanded in the future.
+- **Next Steps**: Planned improvements include enhanced analytics reporting, better support for edge cases in content rendering, and ongoing collaboration with the Content team to add new tools and platforms as needed.
\ No newline at end of file
diff --git a/src/workflows/README.md b/src/workflows/README.md
index 7a870fcd7303..e0c1c0e2d306 100644
--- a/src/workflows/README.md
+++ b/src/workflows/README.md
@@ -1,5 +1,100 @@
 # Workflows
 
-This directory contains workflow scripts that cannot otherwise be in other subject folders.
+The workflows subject contains automation scripts that support GitHub Actions workflows, CLI tools, and repository automation. These scripts handle tasks like PR labeling, cache purging, content change analysis, and repository maintenance.
+
+## Purpose & Scope
+
+This subject is responsible for:
+- PR and issue automation (labeling, metadata, reviewer assignment)
+- Cache management (Fastly edge cache purging)
+- Content validation and reporting (content type checking, change tables)
+- Repository maintenance (orphan file cleanup, syncing)
+- Husky git hooks (pre-commit checks)
+- GitHub Actions support scripts
+
+Note: This directory does not contain a `scripts/` folder since every file here would belong in `scripts/`. Files are organized flat at the top level with supporting utilities in `lib/`.
+
+## Setup & Usage
+
+### Running workflow scripts locally
+
+Scripts are registered in `package.json`:
+
+| Script | Command | Purpose |
+|--------|---------|---------|
+| content-changes-table-comment | `npm run content-changes-table-comment` | Analyzes content changes in PRs |
+| check-content-type | `npm run check-content-type` | Validates content types |
+| delete-orphan-translation-files | `npm run delete-orphan-translation-files` | Removes orphaned translations |
+| enable-automerge | `npm run enable-automerge` | Enables PR automerge |
+| purge-fastly-edge-cache | `npm run purge-fastly-edge-cache` | Purges Fastly CDN cache |
+| prevent-pushes-to-main | (Husky hook) | Prevents pushing to main |
+
+### Running tests
+
+```bash
+npm run test -- src/workflows/tests
+```
+
+### GitHub Actions integration
+
+Many scripts are called from GitHub Actions workflows in `.github/workflows/`. They typically:
+1. Run automatically on PR events, pushes, or schedules
+2. Use GitHub Actions context (`@actions/github`, `@actions/core`)
+3. Require `GITHUB_TOKEN` environment variable
+4. Post results as PR comments or update PR/issue metadata
+
+## Data & External Dependencies
+
+### Data inputs
+- GitHub API: PR data, issue data, file changes, commit history
+- Git repository: File contents, frontmatter, diff information
+- Environment variables: `GITHUB_TOKEN`, `FASTLY_TOKEN`, `BASE_SHA`, `HEAD_SHA`
+
+### Dependencies
+- `@actions/github`, `@actions/core` - GitHub Actions SDK
+- `@octokit/rest` - GitHub API client
+- Fastly API - For cache purging
+- Various internal subjects for content parsing and validation
+
+### Data outputs
+- PR/issue comments - Content change summaries, validation results
+- PR/issue labels - Applied via GitHub API
+- Cache purges - Fastly CDN invalidations
+- Exit codes - Success/failure for CI/CD
+
+## Cross-links & Ownership
+
+### Related subjects
+- [`src/frame`](../frame/README.md) - Frontmatter reading and path utilities
+- [`src/versions`](../versions/README.md) - Version detection for content changes
+- [`src/content-linter`](../content-linter/README.md) - Content validation
+- [`src/git`](../git/README.md) - Git utilities (if exists)
+- GitHub Actions workflows in `.github/workflows/` - Primary consumers
+
+### Ownership
+- Team: Docs Engineering
+
+## Current State & Next Steps
+
+### Known limitations
+- Some scripts require specific environment variables and can't easily run locally without setup
+- Error handling varies across scripts
+- Documentation for individual scripts is sometimes inline-only
+
+### Testing guidance
+- Most workflow scripts have limited automated test coverage
+- Test locally before deploying to Actions when possible
+- Use CLI variants (e.g., `content-changes-table-comment-cli.ts`) for local testing
+
+### Adding new workflow scripts
+When adding a new script:
+1. Create the `.ts` file in `src/workflows/`
+2. Add to `package.json` scripts if it should be runnable via npm
+3. Document any required environment variables
+4. Add to `.github/workflows/` if it should run automatically
+5. Consider creating a `-cli.ts` variant for local testing
+6. Update this README if the script introduces new patterns
+
+### Planned work
+- Standardize error handling and logging across scripts
 
-This directory does not contain a `scripts/` folder, as every file in here would belong in `scripts/`.