diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f16c81f..3bca9cb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,7 +25,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
         with:
           enable-cache: true
@@ -50,7 +50,7 @@ jobs:
       TEST_LIFECYCLE_POSTGRES_URL: postgresql+psycopg://postgres:ci-postgres-password@localhost:5432/trading_stack
       LIFECYCLE_DATABASE_URL: postgresql+psycopg://postgres:ci-postgres-password@localhost:5432/trading_stack
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
         with:
           enable-cache: true
@@ -90,7 +90,7 @@ jobs:
     # migrations, and routes an order to the paper broker and nowhere else.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Build and start the stack
         run: docker compose up -d --build --wait postgres migrate execution-service