diff --git a/.github/workflows/deploy-website.yml b/.github/workflows/deploy-website.yml
index 045e88d..a96bd86 100644
--- a/.github/workflows/deploy-website.yml
+++ b/.github/workflows/deploy-website.yml
@@ -64,7 +64,7 @@ jobs:
       # Pinned to commit SHAs so a moved tag can't swap the action's code.
       # `ref: main` because release events check out the tag (detached HEAD),
       # where the commit step's push could never work.
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: main
 
diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml
index 1921ff0..7fe998c 100644
--- a/.github/workflows/dotnet.yml
+++ b/.github/workflows/dotnet.yml
@@ -66,7 +66,7 @@ jobs:
             audit: false
 
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup .NET
         uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
diff --git a/.github/workflows/package-managers.yml b/.github/workflows/package-managers.yml
index 40ba83b..5beb9cb 100644
--- a/.github/workflows/package-managers.yml
+++ b/.github/workflows/package-managers.yml
@@ -77,10 +77,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Noctis (for the manifest template)
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Checkout scoop-bucket
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: heartached/scoop-bucket
           token: ${{ secrets.SCOOP_BUCKET_TOKEN }}