diff --git a/.github/workflows/build-llvm-linux.yml b/.github/workflows/build-llvm-linux.yml
index d11e729..038f919 100644
--- a/.github/workflows/build-llvm-linux.yml
+++ b/.github/workflows/build-llvm-linux.yml
@@ -61,7 +61,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
@@ -210,7 +210,7 @@ jobs:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
@@ -318,7 +318,7 @@ jobs:
 
     steps:
       - name: Checkout main repo (no submodules)
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: true
           token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/check-updates.yml b/.github/workflows/check-updates.yml
index fdea8de..ae2e7d2 100644
--- a/.github/workflows/check-updates.yml
+++ b/.github/workflows/check-updates.yml
@@ -17,7 +17,7 @@ jobs:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           submodules: false  # tools/ submodule only; prebuilt/ not needed
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4759ae9..c47d480 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,7 +24,7 @@ jobs:
     env:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - run: git submodule update --init --depth 1 tools prebuilt
@@ -51,7 +51,7 @@ jobs:
           - os: windows-latest
             binary: prebuilt/bin/devkit-server-windows-amd64.exe
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - run: git submodule update --init --depth 1 tools prebuilt
diff --git a/.github/workflows/linux-integration.yml b/.github/workflows/linux-integration.yml
index ad128de..c077bf4 100644
--- a/.github/workflows/linux-integration.yml
+++ b/.github/workflows/linux-integration.yml
@@ -115,7 +115,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           lfs: true
diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index 0fd45f0..9123af6 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -20,7 +20,7 @@ jobs:
   secret-scan:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/sign-and-scan.yml b/.github/workflows/sign-and-scan.yml
index 1b87b29..c0ba909 100644
--- a/.github/workflows/sign-and-scan.yml
+++ b/.github/workflows/sign-and-scan.yml
@@ -26,7 +26,7 @@ jobs:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/smoke-test.yml b/.github/workflows/smoke-test.yml
index 2bd9ed1..ef7a26e 100644
--- a/.github/workflows/smoke-test.yml
+++ b/.github/workflows/smoke-test.yml
@@ -66,7 +66,7 @@ jobs:
         run: echo "Skipping ${{ matrix.label }} as requested." && exit 0
 
       - name: Checkout (with all submodules)
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           submodules: recursive