diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 92b54e8..6ce26a0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -76,7 +76,7 @@ jobs:
             rust: ${{ steps.filter.outputs.rust }}
             deps: ${{ steps.filter.outputs.deps }}
         steps:
-            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
             - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
               id: filter
@@ -102,7 +102,7 @@ jobs:
         if: needs.changes.outputs.rust == 'true'
         runs-on: blacksmith-4vcpu-ubuntu-2204
         steps:
-            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
             - name: Install Rust toolchain
               uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
@@ -147,7 +147,7 @@ jobs:
         if: needs.changes.outputs.deps == 'true' || github.event_name == 'schedule'
         runs-on: blacksmith-2vcpu-ubuntu-2204
         steps:
-            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
             # Download pre-built binaries (~2s each) instead of
             # `cargo install` which compiles from source (~60s+).
@@ -195,7 +195,7 @@ jobs:
         name: Secrets scan
         runs-on: blacksmith-2vcpu-ubuntu-2204
         steps:
-            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                   fetch-depth: 0 # full history for scanning all commits
 
@@ -228,7 +228,7 @@ jobs:
         if: needs.changes.outputs.deps == 'true' || github.event_name == 'schedule'
         runs-on: blacksmith-4vcpu-ubuntu-2204
         steps:
-            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
             - name: Install Rust toolchain
               uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a3052b5..b3b9146 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -53,7 +53,7 @@ jobs:
         permissions:
             contents: read
         steps:
-            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
             - name: Check tag matches Cargo.toml version
               if: github.ref_type == 'tag'
@@ -93,7 +93,7 @@ jobs:
                       artifact: vettd-windows-amd64.exe
         runs-on: ${{ matrix.os }}
         steps:
-            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
             - name: Validate embedded update verification key
               shell: bash
@@ -157,7 +157,7 @@ jobs:
         permissions:
             contents: write # create releases + upload assets
         steps:
-            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
             - name: Download all artifacts
               uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
@@ -441,7 +441,7 @@ jobs:
 
             - name: Checkout Homebrew tap
               if: env.HOMEBREW_TAP_TOKEN != ''
-              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                   repository: AgenticHighway/homebrew-tap
                   ref: main