diff --git a/.github/workflows/audience-bundle-size.yaml b/.github/workflows/audience-bundle-size.yaml
index befec1174a..8b93d860a8 100644
--- a/.github/workflows/audience-bundle-size.yaml
+++ b/.github/workflows/audience-bundle-size.yaml
@@ -31,7 +31,7 @@ jobs:
       NX_CLOUD_ACCESS_TOKEN: ${{ secrets.TS_IMMUTABLE_SDK_NX_TOKEN }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           # Full history needed — we check out the base commit later to measure its size.
diff --git a/.github/workflows/build-game-bridge.yaml b/.github/workflows/build-game-bridge.yaml
index 024a250626..c22707f0b6 100644
--- a/.github/workflows/build-game-bridge.yaml
+++ b/.github/workflows/build-game-bridge.yaml
@@ -54,7 +54,7 @@ jobs:
     steps:
       - name: Checkout SDK Repository
         id: checkout-sdk
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1
         with:
           ref: "${{ env.TS_SDK_TAG }}"
           fetch-depth: 0
@@ -126,7 +126,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout SDK Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1
         with:
           ref: "${{ env.TS_SDK_TAG }}"
           persist-credentials: false
@@ -154,7 +154,7 @@ jobs:
             pull_requests: write
 
       - name: Checkout Unity SDK Repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1
         with:
           repository: immutable/unity-immutable-sdk
           token: ${{ steps.github-token.outputs.token }}
@@ -226,7 +226,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout SDK Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1
         with:
           ref: "${{ env.TS_SDK_TAG }}"
           persist-credentials: false
@@ -254,7 +254,7 @@ jobs:
             pull_requests: write
 
       - name: Checkout Unreal SDK Repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1
         with:
           repository: immutable/unreal-immutable-sdk
           token: ${{ steps.github-token.outputs.token }}
diff --git a/.github/workflows/dependency-review.yaml b/.github/workflows/dependency-review.yaml
index a10f5ca4cb..e112c2a0ac 100644
--- a/.github/workflows/dependency-review.yaml
+++ b/.github/workflows/dependency-review.yaml
@@ -26,7 +26,7 @@ jobs:
       pull-requests: read  # read PR diff for dependency analysis
     steps:
       - name: 'Checkout Repository'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/deploy-audience-cdn.yaml b/.github/workflows/deploy-audience-cdn.yaml
index 0fcf1a3db3..73d9dc9923 100644
--- a/.github/workflows/deploy-audience-cdn.yaml
+++ b/.github/workflows/deploy-audience-cdn.yaml
@@ -31,7 +31,7 @@ jobs:
       S3_KEY: audience/v1/imtbl.js
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/deploy-pixel-cdn.yaml b/.github/workflows/deploy-pixel-cdn.yaml
index 48210882b8..ca61db624c 100644
--- a/.github/workflows/deploy-pixel-cdn.yaml
+++ b/.github/workflows/deploy-pixel-cdn.yaml
@@ -31,7 +31,7 @@ jobs:
       S3_KEY: pixel/v1/imtbl.js
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/passport-sample-app-deployment.yaml b/.github/workflows/passport-sample-app-deployment.yaml
index b1d1e5c1ff..a5b978e858 100644
--- a/.github/workflows/passport-sample-app-deployment.yaml
+++ b/.github/workflows/passport-sample-app-deployment.yaml
@@ -37,7 +37,7 @@ jobs:
           aws-region: ${{ env.AWS_REGION }}
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/pixel-bundle-size.yaml b/.github/workflows/pixel-bundle-size.yaml
index fc271ac869..7aecdfa204 100644
--- a/.github/workflows/pixel-bundle-size.yaml
+++ b/.github/workflows/pixel-bundle-size.yaml
@@ -25,7 +25,7 @@ jobs:
       NX_CLOUD_ACCESS_TOKEN: ${{ secrets.TS_IMMUTABLE_SDK_NX_TOKEN }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml
index d96d6f77ef..682a20918c 100644
--- a/.github/workflows/pr.yaml
+++ b/.github/workflows/pr.yaml
@@ -29,7 +29,7 @@ jobs:
       NX_CLOUD_ACCESS_TOKEN: ${{ secrets.TS_IMMUTABLE_SDK_NX_TOKEN }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           fetch-depth: 0
@@ -57,7 +57,7 @@ jobs:
       should-run: ${{ steps.changed-files.outputs.should-run }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -126,7 +126,7 @@ jobs:
 
       - name: Checkout code
         if: needs.should-run-functional-tests.outputs.should-run == 'true'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           persist-credentials: false
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index d83bdf3d69..758cd78b09 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -58,7 +58,7 @@ jobs:
           exit 1
 
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pin@v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1
         with:
           fetch-depth: 0
           ref: ${{ github.ref }}