diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 38aa1cd..847efab 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,7 +26,7 @@ jobs:
     steps:
       # Pinned by commit SHA, not tag: tags are mutable. Dependabot updates
       # these and the trailing comment says which version each SHA is.
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b5ab9c6..9a2be0a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -74,7 +74,7 @@ jobs:
 
       # Pinned by commit SHA, not tag: tags are mutable. Dependabot updates
       # these and the trailing comment says which version each SHA is.
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           ref: ${{ steps.tag.outputs.name }}