diff --git a/.github/workflows/local-python-checks.yml b/.github/workflows/local-python-checks.yml
index 5f27e64f..3f87fe08 100644
--- a/.github/workflows/local-python-checks.yml
+++ b/.github/workflows/local-python-checks.yml
@@ -64,7 +64,7 @@ jobs:
           apt-get install -y --no-install-recommends git ca-certificates
       ## https://github.com/actions/checkout/releases/tag/v6.0.2
       ## > de0fac2e4500dabe0009e67214ff5f5447ce83dd
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Install linters
@@ -82,7 +82,7 @@ jobs:
         ## not vendor a copy; checkout @master keeps the org's
         ## single source of truth. Matches the pattern in
         ## local-python-fuzz.yml.
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           repository: org-ai-assisted/dist-ai
           ref: master
diff --git a/.github/workflows/local-python-fuzz.yml b/.github/workflows/local-python-fuzz.yml
index 3b83ed11..28f7db70 100644
--- a/.github/workflows/local-python-fuzz.yml
+++ b/.github/workflows/local-python-fuzz.yml
@@ -63,7 +63,7 @@ jobs:
       - name: Checkout repository
         ## https://github.com/actions/checkout/releases/tag/v6.0.2
         ## > de0fac2e4500dabe0009e67214ff5f5447ce83dd
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
@@ -92,7 +92,7 @@ jobs:
         ## Needed for usr/bin/step-summary-emit. helper-scripts does
         ## not vendor a copy; checkout @master keeps the org's
         ## single source of truth.
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           repository: org-ai-assisted/dist-ai
           ref: master
@@ -134,7 +134,7 @@ jobs:
       - name: Checkout repository
         ## https://github.com/actions/checkout/releases/tag/v6.0.2
         ## > de0fac2e4500dabe0009e67214ff5f5447ce83dd
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
@@ -161,7 +161,7 @@ jobs:
         if: always()
         ## Needed for usr/bin/step-summary-emit. See same step in the
         ## 'pr' job above for rationale.
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           repository: org-ai-assisted/dist-ai
           ref: master