diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index e695ad5..7a7b727 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -18,7 +18,7 @@ jobs:
     container:
       image: semgrep/semgrep
     steps:
-    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     # Standalone mode (no Semgrep AppSec Platform connection, no
     # SEMGREP_APP_TOKEN): `semgrep ci` requires that token to actually be
     # configured as a repo secret, and fails outright for a fork PR or a