diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 38a8b0c..55f121b 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -25,7 +25,7 @@ jobs:
       packages: write
 
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # The build reads files from the working tree; GHCR auth is handled
           # by docker/login-action below, so the git token is not needed after
diff --git a/.github/workflows/fly-deploy.yml b/.github/workflows/fly-deploy.yml
index 5fac51e..ee1a9f2 100644
--- a/.github/workflows/fly-deploy.yml
+++ b/.github/workflows/fly-deploy.yml
@@ -41,7 +41,7 @@ jobs:
     env:
       RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # refs/tags/ is explicit so a *branch* named v-something can't be
           # checked out here: checkout accepts either for a bare ref.
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index ecda5d3..780a037 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -33,7 +33,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # --new-from-rev diffs against the base branch, so the shallow clone
           # checkout defaults to is not enough history to compute it.
@@ -92,7 +92,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # checkout leaves GITHUB_TOKEN in .git/config by default, where any
           # later step — including third-party actions — can read it. Nothing