diff --git a/.github/workflows/android-apk-release.yml b/.github/workflows/android-apk-release.yml
index e9b501291..89d64e252 100644
--- a/.github/workflows/android-apk-release.yml
+++ b/.github/workflows/android-apk-release.yml
@@ -64,7 +64,7 @@ jobs:
     timeout-minutes: 20
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           sparse-checkout: scripts
           ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.tag || github.ref }}
@@ -105,7 +105,7 @@ jobs:
     timeout-minutes: 90
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
           ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.tag || github.ref }}
diff --git a/.github/workflows/android-play-release.yml b/.github/workflows/android-play-release.yml
index 52a94b228..e49605822 100644
--- a/.github/workflows/android-play-release.yml
+++ b/.github/workflows/android-play-release.yml
@@ -60,7 +60,7 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
           ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.tag || github.ref }}
diff --git a/.github/workflows/audit-shipped.yml b/.github/workflows/audit-shipped.yml
index 0bcc61215..58d2e66d9 100644
--- a/.github/workflows/audit-shipped.yml
+++ b/.github/workflows/audit-shipped.yml
@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-node@v7
         with:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 072c03d1f..de1f08957 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -35,7 +35,7 @@ jobs:
       relay: ${{ steps.filter.outputs.shared != 'false' || steps.filter.outputs.relay != 'false' }}
       cli: ${{ steps.filter.outputs.shared != 'false' || steps.filter.outputs.cli != 'false' }}
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
@@ -127,7 +127,7 @@ jobs:
       # unrelated npm ci failures when Electron's CDN returns 504.
       ELECTRON_SKIP_BINARY_DOWNLOAD: "1"
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-node@v7
         with:
@@ -152,7 +152,7 @@ jobs:
     env:
       ELECTRON_SKIP_BINARY_DOWNLOAD: "1"
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-node@v7
         with:
@@ -190,7 +190,7 @@ jobs:
     env:
       ELECTRON_SKIP_BINARY_DOWNLOAD: "1"
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-node@v7
         with:
@@ -236,7 +236,7 @@ jobs:
         if: env.RUN_TESTS != 'true'
         run: echo "No server changes detected."
 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         if: env.RUN_TESTS == 'true'
         with:
           fetch-depth: 0
@@ -309,7 +309,7 @@ jobs:
         if: env.RUN_TESTS != 'true'
         run: echo "No desktop changes detected."
 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         if: env.RUN_TESTS == 'true'
 
       - uses: actions/setup-node@v7
@@ -389,7 +389,7 @@ jobs:
     env:
       ELECTRON_SKIP_BINARY_DOWNLOAD: "1"
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-node@v7
         with:
@@ -420,7 +420,7 @@ jobs:
     env:
       ELECTRON_SKIP_BINARY_DOWNLOAD: "1"
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-node@v7
         with:
@@ -489,7 +489,7 @@ jobs:
         if: env.RUN_TESTS != 'true'
         run: echo "No Playwright changes detected."
 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         if: env.RUN_TESTS == 'true'
 
       - uses: actions/setup-node@v7
@@ -550,7 +550,7 @@ jobs:
     env:
       ELECTRON_SKIP_BINARY_DOWNLOAD: "1"
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-node@v7
         with:
@@ -587,7 +587,7 @@ jobs:
         if: env.RUN_TESTS != 'true'
         run: echo "No CLI changes detected."
 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         if: env.RUN_TESTS == 'true'
 
       - uses: actions/setup-node@v7
diff --git a/.github/workflows/deploy-app.yml b/.github/workflows/deploy-app.yml
index 7d6366b9d..b80363743 100644
--- a/.github/workflows/deploy-app.yml
+++ b/.github/workflows/deploy-app.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-node@v7
         with:
diff --git a/.github/workflows/deploy-relay.yml b/.github/workflows/deploy-relay.yml
index ad2ed2e2c..90b0fbd7f 100644
--- a/.github/workflows/deploy-relay.yml
+++ b/.github/workflows/deploy-relay.yml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-node@v7
         with:
diff --git a/.github/workflows/deploy-website.yml b/.github/workflows/deploy-website.yml
index f61e0b809..a7d993c1b 100644
--- a/.github/workflows/deploy-website.yml
+++ b/.github/workflows/deploy-website.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: actions/setup-node@v7
         with:
diff --git a/.github/workflows/desktop-release.yml b/.github/workflows/desktop-release.yml
index b43812d6f..6460155fe 100644
--- a/.github/workflows/desktop-release.yml
+++ b/.github/workflows/desktop-release.yml
@@ -75,7 +75,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           sparse-checkout: scripts
           ref: ${{ env.CHECKOUT_REF }}
@@ -132,7 +132,7 @@ jobs:
     runs-on: ${{ matrix.runner }}
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
           ref: ${{ env.CHECKOUT_REF }}
@@ -240,7 +240,7 @@ jobs:
     runs-on: ${{ matrix.runner }}
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
           ref: ${{ env.CHECKOUT_REF }}
@@ -331,7 +331,7 @@ jobs:
     runs-on: ubuntu-22.04
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
           ref: ${{ env.CHECKOUT_REF }}
@@ -426,7 +426,7 @@ jobs:
     runs-on: windows-latest
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
           ref: ${{ env.CHECKOUT_REF }}
@@ -526,7 +526,7 @@ jobs:
       cancel-in-progress: false
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           sparse-checkout: |
             package.json
diff --git a/.github/workflows/desktop-rollout.yml b/.github/workflows/desktop-rollout.yml
index 26d89748e..63276d977 100644
--- a/.github/workflows/desktop-rollout.yml
+++ b/.github/workflows/desktop-rollout.yml
@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           sparse-checkout: |
             package.json
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 3e98109f2..94a29e864 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -66,7 +66,7 @@ jobs:
       check_tag: ${{ steps.values.outputs.check_tag }}
       publish_tags: ${{ steps.values.outputs.publish_tags }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - id: values
         env:
@@ -137,7 +137,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: docker/setup-qemu-action@v4
       - uses: docker/setup-buildx-action@v4
@@ -163,7 +163,7 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: docker/setup-qemu-action@v4
       - uses: docker/setup-buildx-action@v4
diff --git a/.github/workflows/ios-release.yml b/.github/workflows/ios-release.yml
index 54131c3bf..fd5f312ea 100644
--- a/.github/workflows/ios-release.yml
+++ b/.github/workflows/ios-release.yml
@@ -71,7 +71,7 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
           ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.tag || github.ref }}
diff --git a/.github/workflows/nix-update-hash.yml b/.github/workflows/nix-update-hash.yml
index dab32b71a..22f66f745 100644
--- a/.github/workflows/nix-update-hash.yml
+++ b/.github/workflows/nix-update-hash.yml
@@ -27,7 +27,7 @@ jobs:
       # This fork uses the default GITHUB_TOKEN instead of upstream's bot GitHub
       # App (OTTO_BOT_APP_ID / OTTO_BOT_APP_PRIVATE_KEY secrets don't exist here).
       # The [skip ci] in the commit message keeps the push from re-triggering CI.
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           ref: ${{ github.ref }}
 
diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml
index 176733d9d..8ceaa6c36 100644
--- a/.github/workflows/nix.yml
+++ b/.github/workflows/nix.yml
@@ -29,7 +29,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
diff --git a/.github/workflows/release-notes-sync.yml b/.github/workflows/release-notes-sync.yml
index bf09efe74..33ad9a4b7 100644
--- a/.github/workflows/release-notes-sync.yml
+++ b/.github/workflows/release-notes-sync.yml
@@ -42,7 +42,7 @@ jobs:
       contents: write
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0