diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 64d9b3a..592ad08 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,7 +10,7 @@ jobs:
     name: Build Swift package
     runs-on: macos-15
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: install swift-format
         run: brew install swift-format
       # The Homebrew binary by name, not `swift format`: on macos-15 the latter
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3313723..2c37324 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -79,7 +79,7 @@ jobs:
       skip: ${{ steps.decide.outputs.skip }}
       version: ${{ steps.decide.outputs.version }}
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - id: decide
         run: |
           base="$(tr -d '[:space:]' < mac-app/VERSION)"
@@ -130,7 +130,7 @@ jobs:
       # written into mac-app/VERSION, which would mark every release dirty.
       CM_RELEASE_VERSION: ${{ needs.decide.outputs.version }}
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
@@ -262,7 +262,7 @@ jobs:
 
       - name: Upload artifacts (dry run)
         if: env.IS_RELEASE != 'true'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: cloudmachine-${{ env.VERSION }}-dry-run
           path: |
@@ -272,7 +272,7 @@ jobs:
 
       - name: Publish GitHub Release
         if: env.IS_RELEASE == 'true'
-        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
           # Creates the tag on this commit when the run did not start from one.
           tag_name: v${{ env.VERSION }}
@@ -313,7 +313,7 @@ jobs:
 
       - name: Check out tap
         if: env.IS_RELEASE == 'true'
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: RenaCode/homebrew-tap
           token: ${{ steps.tap-token.outputs.token }}