diff --git a/.github/workflows/audit-checksums.yml b/.github/workflows/audit-checksums.yml
index cc413da..5495284 100644
--- a/.github/workflows/audit-checksums.yml
+++ b/.github/workflows/audit-checksums.yml
@@ -15,7 +15,7 @@ jobs:
       issues: write
 
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4e2de07..e9701b9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,7 +13,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # check() calls `git show HEAD:./packages.json`, which needs at least the current
           # commit's blob; HEAD is present even with the default shallow checkout, so depth 2
diff --git a/.github/workflows/keepalive.yml b/.github/workflows/keepalive.yml
index a85987c..2702639 100644
--- a/.github/workflows/keepalive.yml
+++ b/.github/workflows/keepalive.yml
@@ -19,7 +19,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Create keepalive heartbeat
         run: |
diff --git a/.github/workflows/update-packages.yml b/.github/workflows/update-packages.yml
index 1d9849d..3ddca15 100644
--- a/.github/workflows/update-packages.yml
+++ b/.github/workflows/update-packages.yml
@@ -17,7 +17,7 @@ jobs:
       run: ${{ steps.gate.outputs.run }}
 
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
@@ -49,7 +49,7 @@ jobs:
       pushed: ${{ steps.push.outputs.pushed }}
 
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
@@ -136,7 +136,7 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
diff --git a/.github/workflows/validate-badges.yml b/.github/workflows/validate-badges.yml
index 75c6964..ab83ef6 100644
--- a/.github/workflows/validate-badges.yml
+++ b/.github/workflows/validate-badges.yml
@@ -15,7 +15,7 @@ jobs:
       issues: write
 
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with: