diff --git a/.github/workflows/license-check.yaml b/.github/workflows/license-check.yaml
index e9d986b..59a8e13 100644
--- a/.github/workflows/license-check.yaml
+++ b/.github/workflows/license-check.yaml
@@ -8,6 +8,6 @@ jobs:
   license:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Check License Header
         uses: apache/skywalking-eyes/header@6e368ec14f31521edc7118374773e78d2d646aeb
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fdead3c..46ba654 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -56,7 +56,7 @@ jobs:
       oxide-api: ${{ steps.oxide_api.outputs['needs-publishing'] }}
       oxide-openapi-gen-ts: ${{ steps.oxide_openapi_gen_ts.outputs['needs-publishing'] }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Check whether @oxide/api version needs publishing
         id: oxide_api
         working-directory: oxide-api
@@ -98,7 +98,7 @@ jobs:
       contents: read
       id-token: write # required for OIDC trusted publishing
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24 # npm >=11.5.1 required for trusted publishing
@@ -153,7 +153,7 @@ jobs:
             echo "PR #${{ inputs.pr-number }} is from a fork; canaries can only be published for PRs from this repo" >&2
             exit 1
           fi
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # The workflow definition comes from the ref the run is dispatched
           # on, but the `release` environment only allows deployments from
diff --git a/.github/workflows/update-api-spec.yml b/.github/workflows/update-api-spec.yml
index c80b861..6a0da18 100644
--- a/.github/workflows/update-api-spec.yml
+++ b/.github/workflows/update-api-spec.yml
@@ -14,7 +14,7 @@ jobs:
   update-api-spec:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "24"
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index dc4c5f0..27bcc12 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -14,7 +14,7 @@ jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "24"