diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 76350638b..350d15cee 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,7 +27,7 @@ jobs:
     steps:
       - &checkout
         name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Run actionlint
         run: go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 .github/workflows/*.yml
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 31ee80717..69cd95926 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -40,7 +40,7 @@ jobs:
           - python
     steps:
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare workspace temp directory
         run: mkdir -p "$TMPDIR"
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index 7c9bb0b92..1f3e30c9c 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -22,7 +22,7 @@ jobs:
       NEOMACS_MELPA_ORACLE_EMACS: /usr/bin/emacs
     steps:
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare workspace temp directory
         run: mkdir -p "$TMPDIR"
@@ -64,7 +64,7 @@ jobs:
       RUST_BACKTRACE: 1
     steps:
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install system dependencies (apt)
         run: scripts/ci/setup-linux.sh build
diff --git a/.github/workflows/nextest-shards.yml b/.github/workflows/nextest-shards.yml
index 2a5c5c81b..089b5c84a 100644
--- a/.github/workflows/nextest-shards.yml
+++ b/.github/workflows/nextest-shards.yml
@@ -29,7 +29,7 @@ jobs:
         partition: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20]
     steps:
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare workspace temp directory
         run: mkdir -p "$TMPDIR/nextest"
diff --git a/.github/workflows/nix-smoke.yml b/.github/workflows/nix-smoke.yml
index a12645e9d..46e4723d3 100644
--- a/.github/workflows/nix-smoke.yml
+++ b/.github/workflows/nix-smoke.yml
@@ -20,7 +20,7 @@ jobs:
     timeout-minutes: 240
     steps:
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Nix
         uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e82929ad4..644f5fd64 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -28,7 +28,7 @@ jobs:
       TMPDIR: ${{ github.workspace }}/tmp
     steps:
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
@@ -112,7 +112,7 @@ jobs:
       TMPDIR: ${{ github.workspace }}/tmp
     steps:
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
@@ -173,7 +173,7 @@ jobs:
       GSTREAMER_VERSION: 1.26.9
     steps:
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
@@ -229,7 +229,7 @@ jobs:
       GSTREAMER_VERSION: 1.26.9
     steps:
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/tmp_mac_test.yml b/.github/workflows/tmp_mac_test.yml
index c8ae82914..20c749810 100644
--- a/.github/workflows/tmp_mac_test.yml
+++ b/.github/workflows/tmp_mac_test.yml
@@ -17,7 +17,7 @@ jobs:
       RUST_LOG: info
     steps:
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/window-oracle-nightly.yml b/.github/workflows/window-oracle-nightly.yml
index a8de44eea..18dc86ad3 100644
--- a/.github/workflows/window-oracle-nightly.yml
+++ b/.github/workflows/window-oracle-nightly.yml
@@ -55,7 +55,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare workspace temp directory
         run: mkdir -p "$TMPDIR/nextest"
diff --git a/.github/workflows/windows-installer.yml b/.github/workflows/windows-installer.yml
index bc06eab1e..22acfe733 100644
--- a/.github/workflows/windows-installer.yml
+++ b/.github/workflows/windows-installer.yml
@@ -50,7 +50,7 @@ jobs:
       GSTREAMER_VERSION: 1.26.9
     steps:
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0