diff --git a/.github/workflows/audit-archive.yml b/.github/workflows/audit-archive.yml
index 2b8c3116..ce256ba7 100644
--- a/.github/workflows/audit-archive.yml
+++ b/.github/workflows/audit-archive.yml
@@ -96,7 +96,7 @@ jobs:
           fi
       - name: Record absolute job deadline origin
         run: echo "CHEATCODE_AUDIT_ARCHIVE_JOB_STARTED_AT_MS=$(date +%s%3N)" >> "$GITHUB_ENV"
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.sha }}
       - uses: ./.github/actions/setup-repository
diff --git a/.github/workflows/build-snapshot.yml b/.github/workflows/build-snapshot.yml
index 580543ae..6c59354c 100644
--- a/.github/workflows/build-snapshot.yml
+++ b/.github/workflows/build-snapshot.yml
@@ -38,7 +38,7 @@ jobs:
             echo "Confirmation must exactly match BUILD_SNAPSHOT." >&2
             exit 1
           fi
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.sha }}
       - uses: aquasecurity/setup-trivy@81e514348e19b6112ce2a7e3ecbafe19c1e1f567 # v0.3.1
diff --git a/.github/workflows/deploy-cloudflare.yml b/.github/workflows/deploy-cloudflare.yml
index 170aaf07..23f1ad87 100644
--- a/.github/workflows/deploy-cloudflare.yml
+++ b/.github/workflows/deploy-cloudflare.yml
@@ -17,7 +17,7 @@ jobs:
     timeout-minutes: 45
     steps:
       - name: Checkout reviewed release
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.sha }}
 
diff --git a/.github/workflows/static-checks.yml b/.github/workflows/static-checks.yml
index 7669eaf0..fbf9a617 100644
--- a/.github/workflows/static-checks.yml
+++ b/.github/workflows/static-checks.yml
@@ -30,7 +30,7 @@ jobs:
       skills: ${{ steps.scope.outputs.skills }}
       workflow: ${{ steps.scope.outputs.workflow }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
@@ -159,7 +159,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Lint GitHub Actions and embedded shell
         uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2.2.0
         with:
@@ -179,7 +179,7 @@ jobs:
       HEAD_SHA: ${{ needs.changes.outputs.head_sha }}
       SKILLS_CHANGED: ${{ needs.changes.outputs.skills }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           ref: ${{ needs.changes.outputs.head_sha }}