diff --git a/.github/workflows/build-nugetlibrary-task.yml b/.github/workflows/build-nugetlibrary-task.yml
index f3e4113..f9f193c 100644
--- a/.github/workflows/build-nugetlibrary-task.yml
+++ b/.github/workflows/build-nugetlibrary-task.yml
@@ -52,7 +52,7 @@ jobs:
           dotnet-version: 10.x
 
       - name: Checkout code step
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ inputs.ref }}
 
diff --git a/.github/workflows/build-release-task.yml b/.github/workflows/build-release-task.yml
index 9a6880a..440aff2 100644
--- a/.github/workflows/build-release-task.yml
+++ b/.github/workflows/build-release-task.yml
@@ -81,7 +81,7 @@ jobs:
       # possibly-moving `inputs.ref` branch, so the uploaded release files
       # match the tag even if the branch advances mid-run.
       - name: Checkout code step
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ needs.get-version.outputs.GitCommitId }}
 
diff --git a/.github/workflows/get-version-task.yml b/.github/workflows/get-version-task.yml
index 41fdac3..4f4deb6 100644
--- a/.github/workflows/get-version-task.yml
+++ b/.github/workflows/get-version-task.yml
@@ -48,7 +48,7 @@ jobs:
           dotnet-version: 10.x
 
       - name: Checkout code step
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ inputs.ref }}
           fetch-depth: 0
diff --git a/.github/workflows/run-codegen-pull-request-task.yml b/.github/workflows/run-codegen-pull-request-task.yml
index 8732c56..ecdbcfc 100644
--- a/.github/workflows/run-codegen-pull-request-task.yml
+++ b/.github/workflows/run-codegen-pull-request-task.yml
@@ -55,7 +55,7 @@ jobs:
           dotnet-version: 10.x
 
       - name: Checkout code step
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ matrix.target.ref }}
           token: ${{ steps.app-token.outputs.token }}
diff --git a/.github/workflows/test-pull-request.yml b/.github/workflows/test-pull-request.yml
index 59db962..e493ebe 100644
--- a/.github/workflows/test-pull-request.yml
+++ b/.github/workflows/test-pull-request.yml
@@ -65,7 +65,7 @@ jobs:
           dotnet-version: 10.x
 
       - name: Checkout code step
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       # `dotnet husky run` is the repo's git-hook runner; it invokes the same
       # CSharpier + dotnet format style checks the build conventions require.