diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2c7c3f7..0a386b2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,7 +33,7 @@ jobs:
       # pushed in the 2026 supply-chain attack, and tj-actions spread the same
       # way. Dependabot's github-actions ecosystem bumps the SHA and keeps the
       # version comment current.
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # No job in this workflow pushes, so the token has no business
           # outliving the checkout step. Without this, checkout writes the
@@ -76,7 +76,7 @@ jobs:
       # pushed in the 2026 supply-chain attack, and tj-actions spread the same
       # way. Dependabot's github-actions ecosystem bumps the SHA and keeps the
       # version comment current.
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # No job in this workflow pushes, so the token has no business
           # outliving the checkout step. Without this, checkout writes the
@@ -182,7 +182,7 @@ jobs:
       # pushed in the 2026 supply-chain attack, and tj-actions spread the same
       # way. Dependabot's github-actions ecosystem bumps the SHA and keeps the
       # version comment current.
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # No job in this workflow pushes, so the token has no business
           # outliving the checkout step. Without this, checkout writes the
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index f0d5811..1a5a563 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -17,7 +17,7 @@ jobs:
       # Pinned to the commit, not the tag -- a moved tag is how the tj-actions
       # and trivy-action supply-chain attacks spread. Dependabot's
       # github-actions ecosystem bumps the SHA and keeps the comment current.
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # No job in this workflow pushes, so the token has no business
           # outliving the checkout step. Without this, checkout writes the
@@ -54,7 +54,7 @@ jobs:
       # Pinned to the commit, not the tag -- a moved tag is how the tj-actions
       # and trivy-action supply-chain attacks spread. Dependabot's
       # github-actions ecosystem bumps the SHA and keeps the comment current.
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # No job in this workflow pushes, so the token has no business
           # outliving the checkout step. Without this, checkout writes the