diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml
index b45ea2c..09b96b9 100644
--- a/.github/workflows/claude-review.yml
+++ b/.github/workflows/claude-review.yml
@@ -54,7 +54,7 @@ jobs:
               core.warning(`enablePullRequestAutoMerge failed: ${e.message}. PR will need manual merge.`);
             }
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # @v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # @v7.0.0
         if: github.actor != 'dependabot[bot]'
         with:
           fetch-depth: 0
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 7a52a15..c522c50 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -11,7 +11,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # @v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # @v7.0.0
 
       - name: YAML lint
         uses: ibiqlik/action-yamllint@2576378a8e339169678f9939646ee3ee325e845c # @v3
diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index 1e6e771..cd7d872 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -12,7 +12,7 @@ jobs:
   secret-scan:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # @v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # @v7.0.0
         with:
           fetch-depth: 0