diff --git a/.github/workflows/c2-reconciler-canary.yml b/.github/workflows/c2-reconciler-canary.yml
index d4e69bb5..93813563 100644
--- a/.github/workflows/c2-reconciler-canary.yml
+++ b/.github/workflows/c2-reconciler-canary.yml
@@ -36,7 +36,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v4
 
       - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff  # v5
         with:
diff --git a/.github/workflows/c6-engine-wiring-canary.yml b/.github/workflows/c6-engine-wiring-canary.yml
index f79579cb..5921f9bb 100644
--- a/.github/workflows/c6-engine-wiring-canary.yml
+++ b/.github/workflows/c6-engine-wiring-canary.yml
@@ -42,7 +42,7 @@ jobs:
     runs-on: ${{ github.event.inputs.runner || 'ubuntu-latest' }}
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v5
         with:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ea26d7e6..2125f0ed 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,7 +27,7 @@ jobs:
       contents: read
     steps:
     - name: Checkout
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v6
 
     - name: Setup Go
       uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6
@@ -128,7 +128,7 @@ jobs:
       contents: read
     steps:
     - name: Checkout
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v6
 
     - name: Setup Go
       uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6
@@ -183,7 +183,7 @@ jobs:
       contents: read
     steps:
     - name: Checkout
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v6
 
     - name: Setup Go
       uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6
@@ -201,7 +201,7 @@ jobs:
       contents: read
     steps:
     - name: Checkout
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v6
 
     - name: Setup Go
       uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6
@@ -221,7 +221,7 @@ jobs:
       contents: read
     steps:
     - name: Checkout
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v6
 
     - name: Setup Go
       uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6
@@ -241,7 +241,7 @@ jobs:
       IMAGE_TAG: ci-${{ github.sha }}
     steps:
     - name: Checkout
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v6
 
     - name: Set up Syft
       uses: ./.github/actions/setup-syft
@@ -275,7 +275,7 @@ jobs:
       contents: read
     steps:
     - name: Checkout
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v6
 
     - name: Setup Go
       uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6
@@ -360,7 +360,7 @@ jobs:
       IMAGE_TAG: ci-${{ github.sha }}
     steps:
     - name: Checkout
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v6
 
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5  # v4
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index e0b4e6ec..82d6c502 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -31,7 +31,7 @@ jobs:
       packages: read
     steps:
     - name: Checkout
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v6
 
     - name: Setup Go
       uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6
diff --git a/.github/workflows/codex-review.yml b/.github/workflows/codex-review.yml
index 87ae798e..25258589 100644
--- a/.github/workflows/codex-review.yml
+++ b/.github/workflows/codex-review.yml
@@ -37,7 +37,7 @@ jobs:
     outputs:
       final_message: ${{ steps.run_codex.outputs.final-message }}
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v6
       with:
         # Check out the PR's merge commit.
         ref: refs/pull/${{ github.event.pull_request.number }}/merge
diff --git a/.github/workflows/cpu-substrate-canary.yml b/.github/workflows/cpu-substrate-canary.yml
index bf9df804..1c6eee39 100644
--- a/.github/workflows/cpu-substrate-canary.yml
+++ b/.github/workflows/cpu-substrate-canary.yml
@@ -32,7 +32,7 @@ jobs:
     runs-on: ${{ github.event.inputs.runner || 'ubuntu-latest' }}
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-go@v5
         with:
diff --git a/.github/workflows/default-install-smoke.yml b/.github/workflows/default-install-smoke.yml
index 0934832e..6d10d8a4 100644
--- a/.github/workflows/default-install-smoke.yml
+++ b/.github/workflows/default-install-smoke.yml
@@ -52,7 +52,7 @@ jobs:
     # CNI still leaves room for the exit trap to collect diagnostics.
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v4
 
       - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff  # v5
         with:
diff --git a/.github/workflows/release-sbom.yml b/.github/workflows/release-sbom.yml
index 89060086..7dcf703f 100644
--- a/.github/workflows/release-sbom.yml
+++ b/.github/workflows/release-sbom.yml
@@ -40,7 +40,7 @@ jobs:
         fi
 
     - name: Checkout SBOM tooling
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v6
       with:
         ref: ${{ github.workflow_sha }}
         persist-credentials: false
@@ -67,7 +67,7 @@ jobs:
         password: ${{ github.token }}
 
     - name: Checkout release source
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v6
       with:
         ref: refs/tags/${{ env.RELEASE_TAG }}
         path: release-source