diff --git a/.github/workflows/cowork-smoke.yml b/.github/workflows/cowork-smoke.yml
index 8811690f..a8d39de9 100644
--- a/.github/workflows/cowork-smoke.yml
+++ b/.github/workflows/cowork-smoke.yml
@@ -19,7 +19,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Check out repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/hardware-ready.yml b/.github/workflows/hardware-ready.yml
index 80ea8f89..1574917e 100644
--- a/.github/workflows/hardware-ready.yml
+++ b/.github/workflows/hardware-ready.yml
@@ -42,7 +42,7 @@ jobs:
     timeout-minutes: 20
     steps:
       - name: Check out repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/mujoco-sim.yml b/.github/workflows/mujoco-sim.yml
index 136c65f4..6b738729 100644
--- a/.github/workflows/mujoco-sim.yml
+++ b/.github/workflows/mujoco-sim.yml
@@ -29,7 +29,7 @@ jobs:
       DAPIER_SOURCE_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/robotwin-contract.yml b/.github/workflows/robotwin-contract.yml
index aca45746..307ff102 100644
--- a/.github/workflows/robotwin-contract.yml
+++ b/.github/workflows/robotwin-contract.yml
@@ -19,7 +19,7 @@ jobs:
       PYTHONDONTWRITEBYTECODE: "1"
     steps:
       - name: Check out review tree without persisted credentials
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false