diff --git a/.github/workflows/Semgrep.yml b/.github/workflows/Semgrep.yml
index b5e3e66..eccb743 100644
--- a/.github/workflows/Semgrep.yml
+++ b/.github/workflows/Semgrep.yml
@@ -33,7 +33,7 @@ jobs:
 
     steps:
       # Fetch project source with GitHub Actions Checkout.
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       # Run the "semgrep ci" command on the command line of the docker image.
       - run: semgrep ci --sarif --output=semgrep.sarif
         env:
diff --git a/.github/workflows/semgrep-image-pin-drift.yml b/.github/workflows/semgrep-image-pin-drift.yml
index 1b0320c..091a863 100644
--- a/.github/workflows/semgrep-image-pin-drift.yml
+++ b/.github/workflows/semgrep-image-pin-drift.yml
@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Fail if the pinned Semgrep image digest is stale
         run: |
           # NOTE: GitHub runs this as `bash -e {0}`; `set -uo pipefail` does not clear
diff --git a/.github/workflows/spm-smoke-test.yml b/.github/workflows/spm-smoke-test.yml
index f74267d..f8da348 100644
--- a/.github/workflows/spm-smoke-test.yml
+++ b/.github/workflows/spm-smoke-test.yml
@@ -43,7 +43,7 @@ jobs:
       RUN_A11Y_SCAN: "1"
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Swift toolchain
         run: swift --version
@@ -91,7 +91,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Every script under scripts/ — the bash, zsh and fish variants alike — is
       # a bash script (`#!/usr/bin/env bash -il`); the variants differ only in which
@@ -134,7 +134,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Exercise verify_binary_integrity (fail-open / fail-closed matrix)
         run: |
           set -uo pipefail
diff --git a/.github/workflows/verify-selfupdate-checksums.yml b/.github/workflows/verify-selfupdate-checksums.yml
index 1c088cd..ad525ad 100644
--- a/.github/workflows/verify-selfupdate-checksums.yml
+++ b/.github/workflows/verify-selfupdate-checksums.yml
@@ -24,7 +24,7 @@ jobs:
   verify-sidecars:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Verify scripts and .sha256 sidecars are in sync
         run: |