diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 584f76c..7361f4b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -49,7 +49,7 @@ jobs:
           --health-retries=10
 
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up PHP
         uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240  # v2
@@ -142,7 +142,7 @@ jobs:
           --health-retries=20
 
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up PHP
         uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240  # v2
@@ -185,7 +185,7 @@ jobs:
     steps:
       - name: Check out candidate source
         if: ${{ github.server_url != 'https://github.com' }}
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/devcontainer-image-pr.yml b/.github/workflows/devcontainer-image-pr.yml
index f5df7b2..7464457 100644
--- a/.github/workflows/devcontainer-image-pr.yml
+++ b/.github/workflows/devcontainer-image-pr.yml
@@ -57,7 +57,7 @@ jobs:
         id: timing-start
         run: echo "started_ms=$(date +%s%3N)" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
@@ -127,7 +127,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/devcontainer-image.yml b/.github/workflows/devcontainer-image.yml
index bf1e6c8..66d20a8 100644
--- a/.github/workflows/devcontainer-image.yml
+++ b/.github/workflows/devcontainer-image.yml
@@ -105,7 +105,7 @@ jobs:
         id: timing-start
         run: echo "started_ms=$(date +%s%3N)" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
@@ -438,7 +438,7 @@ jobs:
         id: timing-start
         run: echo "started_ms=$(date +%s%3N)" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
@@ -737,7 +737,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/polyglot-validation.yml b/.github/workflows/polyglot-validation.yml
index 5ba30c3..cb5cc01 100644
--- a/.github/workflows/polyglot-validation.yml
+++ b/.github/workflows/polyglot-validation.yml
@@ -28,7 +28,7 @@ jobs:
       POLYGLOT_BUILD_CACHE_MODE: ${{ matrix.cache_mode }}
 
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Test polyglot metadata evidence
         run: python3 -m unittest discover -s polyglot/python_worker/tests -v
diff --git a/.github/workflows/public-boundary.yml b/.github/workflows/public-boundary.yml
index 4242ca9..552d831 100644
--- a/.github/workflows/public-boundary.yml
+++ b/.github/workflows/public-boundary.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/smoke.yml b/.github/workflows/smoke.yml
index 79c1adf..a576943 100644
--- a/.github/workflows/smoke.yml
+++ b/.github/workflows/smoke.yml
@@ -23,7 +23,7 @@ jobs:
       SAMPLE_APP_SMOKE_ONLY: 1
 
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Build and start stack
         run: docker compose up -d --build --wait app worker
@@ -52,7 +52,7 @@ jobs:
       SERVICE_MODE_PORT: "18081"
 
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Export the supported artifact tuple for diagnostics and cleanup
         run: scripts/resolve-current-artifacts.sh >> "$GITHUB_ENV"