diff --git a/.github/workflows/continuous-integration.yml b/.github/workflows/continuous-integration.yml
index 4dff90c0..bd039dab 100644
--- a/.github/workflows/continuous-integration.yml
+++ b/.github/workflows/continuous-integration.yml
@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Scripts
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Test Pull Request Deployments
         env:
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 25cd254d..8dedd955 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0 # This causes all history to be fetched, which is required for calculate-version to function
 
diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml
index 7f8d47f6..03b4d551 100644
--- a/.github/workflows/sbom.yml
+++ b/.github/workflows/sbom.yml
@@ -24,7 +24,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Setup Python 3.13
         uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
diff --git a/azure/components/aws-assume-role.yml b/azure/components/aws-assume-role.yml
index e80e678d..0bb3e34c 100644
--- a/azure/components/aws-assume-role.yml
+++ b/azure/components/aws-assume-role.yml
@@ -37,7 +37,9 @@ steps:
       if [[ "$AWS_ACCOUNT" =~ ^(prod|dev)$ ]]; then
           echo "account is $AWS_ACCOUNT"
           account_id="$(aws ssm get-parameter --name /account-ids/$AWS_ACCOUNT --query Parameter.Value --output text)"
-          aws_role="arn:aws:iam::${account_id}:role/${aws_role}"
+          if [[ "${aws_role}" != arn:aws:iam:* ]]; then
+              aws_role="arn:aws:iam::${account_id}:role/${aws_role}"
+          fi
       fi
 
       if [[ "${aws_role}" != arn:aws:iam:* ]]; then