diff --git a/.github/workflows/branch-deploy.yml b/.github/workflows/branch-deploy.yml
index 87e2dae5..01564e7f 100644
--- a/.github/workflows/branch-deploy.yml
+++ b/.github/workflows/branch-deploy.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: github/branch-deploy@v9
+      - uses: github/branch-deploy@v10
         id: branch-deploy
         with:
           admins: the-hideout/core-contributors
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 25dd5041..855c92db 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -13,11 +13,12 @@ jobs:
     runs-on: ubuntu-latest
     outputs: # set outputs for use in downstream jobs
       continue: ${{ steps.deployment-check.outputs.continue }}
+      sha: ${{ steps.deployment-check.outputs.sha }}
 
     steps:
       # https://github.com/github/branch-deploy/blob/d3c24bd92505e623615b75ffdfac5ed5259adbdb/docs/merge-commit-strategy.md
       - name: deployment check
-        uses: github/branch-deploy@v9
+        uses: github/branch-deploy@v10
         id: deployment-check
         with:
           merge_deploy_mode: "true"
@@ -32,6 +33,8 @@ jobs:
     steps:
       - name: checkout
         uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.deployment-check.outputs.sha }}
 
       - name: setup node
         uses: actions/setup-node@v4
diff --git a/.github/workflows/unlock-on-merge.yml b/.github/workflows/unlock-on-merge.yml
index c12844d1..56a7c65e 100644
--- a/.github/workflows/unlock-on-merge.yml
+++ b/.github/workflows/unlock-on-merge.yml
@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: unlock on merge
-        uses: github/branch-deploy@v9
+        uses: github/branch-deploy@v10
         id: unlock-on-merge
         with:
           unlock_on_merge_mode: "true" # <-- indicates that this is the "Unlock on Merge Mode" workflow