diff --git a/.github/workflows/build-container.yml b/.github/workflows/build-container.yml
index 2da2ae152999..078a3e84a5ec 100644
--- a/.github/workflows/build-container.yml
+++ b/.github/workflows/build-container.yml
@@ -41,6 +41,8 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          allow-unsafe-pr-checkout: true
+          persist-credentials: false
 
       - name: Prepare variables
         id: prepare
@@ -85,6 +87,8 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          allow-unsafe-pr-checkout: true
+          persist-credentials: false
 
       - name: Prepare variables
         id: prepare
@@ -128,6 +132,8 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          allow-unsafe-pr-checkout: true
+          persist-credentials: false
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
diff --git a/.github/workflows/build-depends.yml b/.github/workflows/build-depends.yml
index 184df31176fe..07b89e270203 100644
--- a/.github/workflows/build-depends.yml
+++ b/.github/workflows/build-depends.yml
@@ -52,6 +52,8 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          allow-unsafe-pr-checkout: true
+          persist-credentials: false
           sparse-checkout: |
             ci/dash
             ci/test
@@ -134,6 +136,8 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          allow-unsafe-pr-checkout: true
+          persist-credentials: false
 
       - name: Restore depends sources
         uses: actions/cache/restore@v5
diff --git a/.github/workflows/build-src.yml b/.github/workflows/build-src.yml
index 0b5ad76c010c..8ea9ba443378 100644
--- a/.github/workflows/build-src.yml
+++ b/.github/workflows/build-src.yml
@@ -57,6 +57,8 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          allow-unsafe-pr-checkout: true
+          persist-credentials: false
           fetch-depth: 50
 
       - name: Initial setup
diff --git a/.github/workflows/cache-depends-sources.yml b/.github/workflows/cache-depends-sources.yml
index 60dfa4457ab1..122851d8cd72 100644
--- a/.github/workflows/cache-depends-sources.yml
+++ b/.github/workflows/cache-depends-sources.yml
@@ -23,6 +23,8 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          allow-unsafe-pr-checkout: true
+          persist-credentials: false
 
       - name: Check for cached sources
         id: cache-check
diff --git a/.github/workflows/guix-build.yml b/.github/workflows/guix-build.yml
index 5c3bc61d39c9..98ecc74afe9e 100644
--- a/.github/workflows/guix-build.yml
+++ b/.github/workflows/guix-build.yml
@@ -28,6 +28,8 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          allow-unsafe-pr-checkout: true
+          persist-credentials: false
           path: dash
           fetch-depth: 0
 
@@ -87,6 +89,8 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          allow-unsafe-pr-checkout: true
+          persist-credentials: false
           path: dash
           fetch-depth: 0
 
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index a411130eb42c..b936e2657c78 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -24,6 +24,8 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          allow-unsafe-pr-checkout: true
+          persist-credentials: false
           fetch-depth: 50
 
       - name: Initial setup
diff --git a/.github/workflows/test-src.yml b/.github/workflows/test-src.yml
index 0f6e22ec0b0d..f27751be60a2 100644
--- a/.github/workflows/test-src.yml
+++ b/.github/workflows/test-src.yml
@@ -36,6 +36,8 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          allow-unsafe-pr-checkout: true
+          persist-credentials: false
           fetch-depth: 1
 
       - name: Download build artifacts