diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7d534de..9e7fafa 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: "ubuntu-latest"
     steps:
       - name: "Check out the repo"
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: "Get current branch"
@@ -96,7 +96,7 @@ jobs:
           target: ${{ matrix.config.target }}
       - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
       - name: "Checkout code"
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Build upt
         if: matrix.config.cross == false
         run: "cargo rustc --release --target ${{ matrix.config.target }}"
@@ -138,7 +138,7 @@ jobs:
     needs: [ "release-tag" ]
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: "Create SBOM"
         uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
         with:
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 8c95d66..0282ab5 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     # selecting a toolchain either by action or manual `rustup` calls should happen
     # before the plugin, as the cache uses the current rustc version as its cache key
     - run: rustup toolchain install stable --profile minimal