diff --git a/.github/workflows/agent-image-smoke.yml b/.github/workflows/agent-image-smoke.yml
index 01d4c3578..f92d558d1 100644
--- a/.github/workflows/agent-image-smoke.yml
+++ b/.github/workflows/agent-image-smoke.yml
@@ -45,7 +45,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
           # Need origin/master reachable to diff this branch's Dockerfiles
           # against the pre-change baseline for the size-delta report below.
@@ -214,7 +214,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Build agent-base (devops FROM target)
         run: docker build -f docker/agent-base.Dockerfile -t roboco-agent-base .
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 24de6fa7c..f2e1946ad 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -167,7 +167,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
           # The release-readiness smoke test calls ``git describe --tags`` to
           # find the most recent release tag. ``actions/checkout``'s default
diff --git a/.github/workflows/code-ql.yml b/.github/workflows/code-ql.yml
index ecaa6811b..9cc78fb93 100644
--- a/.github/workflows/code-ql.yml
+++ b/.github/workflows/code-ql.yml
@@ -58,7 +58,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4.38.3
diff --git a/.github/workflows/codeql-js-ts.yml b/.github/workflows/codeql-js-ts.yml
index d3a1e2fe5..12a713d17 100644
--- a/.github/workflows/codeql-js-ts.yml
+++ b/.github/workflows/codeql-js-ts.yml
@@ -50,7 +50,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4.38.3
diff --git a/.github/workflows/decisions-sidecar.yml b/.github/workflows/decisions-sidecar.yml
index 4c73a23f5..66be54940 100644
--- a/.github/workflows/decisions-sidecar.yml
+++ b/.github/workflows/decisions-sidecar.yml
@@ -64,7 +64,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - name: Set up Python
         uses: actions/setup-python@v7
@@ -210,7 +210,7 @@ jobs:
     timeout-minutes: 60
     if: github.event_name != 'pull_request'
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       # FETCH_CLEF_WEIGHTS=false: the 19GB clef GGUF stays NAS-side. This
       # job validates the multi-stage build machinery (llama.cpp compile at
diff --git a/.github/workflows/docksec.yml b/.github/workflows/docksec.yml
index 6c20e15b3..93deabb95 100644
--- a/.github/workflows/docksec.yml
+++ b/.github/workflows/docksec.yml
@@ -48,7 +48,7 @@ jobs:
       DOCKERFILE: ${{ matrix.dockerfile }}
     steps:
       - name: Checkout
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 89d7831a7..a33484ed6 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -37,7 +37,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - name: Upload Pages artifact
         uses: actions/upload-pages-artifact@v5
         with:
diff --git a/.github/workflows/e2e-smoke.yml b/.github/workflows/e2e-smoke.yml
index fc0d14d83..6ea8a62ea 100644
--- a/.github/workflows/e2e-smoke.yml
+++ b/.github/workflows/e2e-smoke.yml
@@ -84,7 +84,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Set up Python
         uses: actions/setup-python@v7
diff --git a/.github/workflows/panel-ci.yml b/.github/workflows/panel-ci.yml
index ffef47581..298a19b17 100644
--- a/.github/workflows/panel-ci.yml
+++ b/.github/workflows/panel-ci.yml
@@ -50,7 +50,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
           # The release-readiness smoke test calls ``git describe --tags`` to
           # find the most recent release tag. ``actions/checkout``'s default
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c197c0fba..9873aaf1e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -26,7 +26,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Free up runner disk space
         run: |
@@ -253,7 +253,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Free up runner disk space
         run: |
diff --git a/.github/workflows/sync-labels.yml b/.github/workflows/sync-labels.yml
index 5c606617c..3b19d834e 100644
--- a/.github/workflows/sync-labels.yml
+++ b/.github/workflows/sync-labels.yml
@@ -21,7 +21,7 @@ jobs:
   labeler:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - name: Sync labels from .github/labels.yml
         uses: crazy-max/ghaction-github-labeler@v6