diff --git a/.github/workflows/flux-localhost-build.yaml b/.github/workflows/flux-localhost-build.yaml
index 1781c2c627..efa52d8708 100644
--- a/.github/workflows/flux-localhost-build.yaml
+++ b/.github/workflows/flux-localhost-build.yaml
@@ -51,7 +51,7 @@ jobs:
           version: "${{ env.FLUX_VERSION }}"
 
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           token: "${{ steps.oauth-token.outputs.token }}"
 
diff --git a/.github/workflows/ostree-build.yaml b/.github/workflows/ostree-build.yaml
index 3b9fc845b7..a95724186b 100644
--- a/.github/workflows/ostree-build.yaml
+++ b/.github/workflows/ostree-build.yaml
@@ -40,7 +40,7 @@ jobs:
           private-key: "${{ secrets.BOT_JWT_PRIVATE_KEY }}" # $BOT_JWT_PRIVATE_KEY is generated in GitHub App main settings page, uses the X.509 private key format
 
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           token: "${{ steps.oauth-token.outputs.token }}"
 
diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml
index 29025d42cd..1e3e7ad9eb 100644
--- a/.github/workflows/renovate.yaml
+++ b/.github/workflows/renovate.yaml
@@ -84,7 +84,7 @@ jobs:
           owner: "${{ github.repository_owner }}"
 
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           token: "${{ steps.oauth-token.outputs.token }}"