diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index df54e63..f81a72c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Set up Node.js
         uses: actions/setup-node@v7
diff --git a/.github/workflows/nextrelease.yml b/.github/workflows/nextrelease.yml
index 8d018f5..cd936ae 100644
--- a/.github/workflows/nextrelease.yml
+++ b/.github/workflows/nextrelease.yml
@@ -11,7 +11,7 @@ jobs:
     if: ${{ github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.action != 'closed' && github.head_ref == 'nextrelease') }}
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@v7.0.1
       with:
         fetch-depth: 0
     - uses: actions/setup-node@v7
@@ -34,7 +34,7 @@ jobs:
     permissions:
       contents: write
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@v7.0.1
       with:
         fetch-depth: 0
         ref: ${{ github.event.pull_request.base.ref }}
diff --git a/.github/workflows/pr-visual-recap.yml b/.github/workflows/pr-visual-recap.yml
index 9911d2a..8f3126c 100644
--- a/.github/workflows/pr-visual-recap.yml
+++ b/.github/workflows/pr-visual-recap.yml
@@ -305,7 +305,7 @@ jobs:
       VISUAL_RECAP_SKILL_SOURCE: ${{ vars.VISUAL_RECAP_SKILL_SOURCE || 'auto' }}
       VISUAL_RECAP_SECRET_SCAN: ${{ vars.VISUAL_RECAP_SECRET_SCAN || 'high-confidence' }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           # This job runs an agent over untrusted PR diff; don't leave the token
@@ -327,7 +327,7 @@ jobs:
             echo "local=false" >> "$GITHUB_OUTPUT"
           fi
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         if: steps.cli.outputs.local == 'true'
         with:
           ref: ${{ github.event.pull_request.base.sha }}