diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0bada81..13b6f7c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -76,7 +76,7 @@ jobs:
             rust: ${{ steps.filter.outputs.rust }}
             deps: ${{ steps.filter.outputs.deps }}
         steps:
-            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
             - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
               id: filter
@@ -101,7 +101,7 @@ jobs:
         if: needs.changes.outputs.rust == 'true'
         runs-on: blacksmith-4vcpu-ubuntu-2204
         steps:
-            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
             - name: Install Rust toolchain
               uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
@@ -146,7 +146,7 @@ jobs:
         if: needs.changes.outputs.deps == 'true' || github.event_name == 'schedule'
         runs-on: blacksmith-2vcpu-ubuntu-2204
         steps:
-            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
             # Download pre-built binaries (~2s each) instead of
             # `cargo install` which compiles from source (~60s+).
@@ -194,7 +194,7 @@ jobs:
         name: Secrets scan
         runs-on: blacksmith-2vcpu-ubuntu-2204
         steps:
-            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
               with:
                   fetch-depth: 0 # full history for scanning all commits
 
@@ -227,7 +227,7 @@ jobs:
         if: needs.changes.outputs.deps == 'true' || github.event_name == 'schedule'
         runs-on: blacksmith-4vcpu-ubuntu-2204
         steps:
-            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
             - name: Install Rust toolchain
               uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f8a6ac0..1ae9cf1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -69,7 +69,7 @@ jobs:
                       artifact: vettd-windows-amd64.exe
         runs-on: ${{ matrix.os }}
         steps:
-            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
             - name: Validate embedded update verification key
               shell: bash
@@ -133,7 +133,7 @@ jobs:
         permissions:
             contents: write # create releases + upload assets
         steps:
-            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
             - name: Download all artifacts
               uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
@@ -417,7 +417,7 @@ jobs:
 
             - name: Checkout Homebrew tap
               if: env.HOMEBREW_TAP_TOKEN != ''
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
               with:
                   repository: AgenticHighway/homebrew-tap
                   ref: main