diff --git a/.github/workflows/allstar.yml b/.github/workflows/allstar.yml
index c9b8563..7d81a1a 100644
--- a/.github/workflows/allstar.yml
+++ b/.github/workflows/allstar.yml
@@ -23,7 +23,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout Allstar source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: ossf/allstar
           ref: main
@@ -65,7 +65,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout this repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - name: Download scan artifacts
diff --git a/.github/workflows/production-sync.yml b/.github/workflows/production-sync.yml
index 28a10a8..41436e9 100644
--- a/.github/workflows/production-sync.yml
+++ b/.github/workflows/production-sync.yml
@@ -21,7 +21,7 @@ jobs:
           egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 
       - name: Checkout repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set GitHub token
         run: echo ${{ secrets.AUGGIE_BOT_TOKEN }} > token
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 33e5c84..d19fe2a 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -18,7 +18,7 @@ jobs:
           egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 
       - name: Checkout repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set GitHub token
         run: echo ${{ secrets.AUGGIE_BOT_TOKEN }} > token
@@ -39,7 +39,7 @@ jobs:
           egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 
       - name: Checkout repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set GitHub token
         run: echo ${{ secrets.AUGGIE_BOT_TOKEN }} > token