diff --git a/.github/workflows/required-quality-gate.yml b/.github/workflows/required-quality-gate.yml
index 3f0a9d0..dc70fdd 100644
--- a/.github/workflows/required-quality-gate.yml
+++ b/.github/workflows/required-quality-gate.yml
@@ -38,7 +38,7 @@ jobs:
           done
 
       - name: Check out caller repository history
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.sha || github.event.merge_group.head_sha }}
@@ -46,7 +46,7 @@ jobs:
           persist-credentials: false
 
       - name: Check out immutable organization commit policy
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: HMG-AI/.github
           ref: ${{ github.workflow_sha }}
@@ -77,7 +77,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Check out immutable organization policy
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           repository: HMG-AI/.github
           ref: ${{ github.workflow_sha }}
@@ -85,7 +85,7 @@ jobs:
           persist-credentials: false
 
       - name: Check out exact event head
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           ref: ${{ github.event.pull_request.head.sha || github.event.merge_group.head_sha }}
           fetch-depth: 0
diff --git a/.github/workflows/reusable-commitlint.yml b/.github/workflows/reusable-commitlint.yml
index 797baf9..23cec44 100644
--- a/.github/workflows/reusable-commitlint.yml
+++ b/.github/workflows/reusable-commitlint.yml
@@ -46,7 +46,7 @@ jobs:
           done
 
       - name: Check out caller repository history
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           ref: ${{ inputs.head_sha }}
@@ -54,7 +54,7 @@ jobs:
           persist-credentials: false
 
       - name: Check out trusted commitlint assets
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: HMG-AI/.github
           ref: 96bdc215df3db73fd1394e1e4f831e7e58caa702
diff --git a/.github/workflows/reusable-hmg-public-promotion.yml b/.github/workflows/reusable-hmg-public-promotion.yml
index 839e59d..2755ce6 100644
--- a/.github/workflows/reusable-hmg-public-promotion.yml
+++ b/.github/workflows/reusable-hmg-public-promotion.yml
@@ -123,7 +123,7 @@ jobs:
           } >> "${GITHUB_OUTPUT}"
 
       - name: Check out the exact reviewed HMG source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ steps.source-run.outputs.sha }}
           fetch-depth: 0
@@ -166,7 +166,7 @@ jobs:
           echo "sha=${source_sha}" >> "${GITHUB_OUTPUT}"
 
       - name: Check out the protected target base
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: HMG-AI/HMG-public
           ref: main
@@ -525,7 +525,7 @@ jobs:
       contents: read
     steps:
       - name: Check out the current protected target base
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: HMG-AI/HMG-public
           ref: main
diff --git a/.github/workflows/reusable-hmg-public-quality.yml b/.github/workflows/reusable-hmg-public-quality.yml
index acabb9b..106b622 100644
--- a/.github/workflows/reusable-hmg-public-quality.yml
+++ b/.github/workflows/reusable-hmg-public-quality.yml
@@ -77,7 +77,7 @@ jobs:
           fi
 
       - name: Check out the candidate with full history
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.head_sha }}
           fetch-depth: 0