diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c9b6703..e1eee93 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,7 +21,7 @@ jobs:
       matrix:
         task: [typecheck, test, build]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version: "1.3.13"
@@ -41,7 +41,7 @@ jobs:
       matrix:
         check: [snapshot-policy, deps-policy]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
@@ -60,7 +60,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version: "1.3.13"
diff --git a/.github/workflows/cli-pr-review.yml b/.github/workflows/cli-pr-review.yml
index 7dc45fa..d53bc11 100644
--- a/.github/workflows/cli-pr-review.yml
+++ b/.github/workflows/cli-pr-review.yml
@@ -128,14 +128,14 @@ jobs:
 
       - name: Checkout PR branch (pull_request / pull_request_review events)
         if: steps.scenario.outputs.name != 'skip' && steps.cap.outputs.exceeded != 'true' && github.event_name != 'issue_comment'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.ref }}
 
       - name: Checkout default branch then PR branch (issue_comment)
         if: steps.scenario.outputs.name != 'skip' && steps.cap.outputs.exceeded != 'true' && github.event_name == 'issue_comment'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
@@ -205,7 +205,7 @@ jobs:
 
           echo "Wrote sanitized untrusted context to $out ($(wc -c < "$out") bytes)."
 
-      - uses: anthropics/claude-code-action@787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251 # v1.0.133
+      - uses: anthropics/claude-code-action@be7b93b1907a4abad570368f3c74b6fe3807510b # v1.0.183
         if: steps.scenario.outputs.name != 'skip' && steps.cap.outputs.exceeded != 'true'
         env:
           GH_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/release-binaries.yaml b/.github/workflows/release-binaries.yaml
index f08435a..728cef2 100644
--- a/.github/workflows/release-binaries.yaml
+++ b/.github/workflows/release-binaries.yaml
@@ -64,7 +64,7 @@ jobs:
           fi
 
       - if: steps.tag.outputs.skip != 'true'
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: ${{ steps.tag.outputs.tag }}
 
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index fe97d59..42e6321 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false