diff --git a/.github/workflows/browserslist-update-db.yml b/.github/workflows/browserslist-update-db.yml
index 80fa70ca969..251cb0d7a0f 100644
--- a/.github/workflows/browserslist-update-db.yml
+++ b/.github/workflows/browserslist-update-db.yml
@@ -19,7 +19,7 @@ jobs:
       pull-requests: "write" # creates a pull request if there's an update
     steps:
       - name: "Checkout repository"
-        uses: "actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10" # v6.0.3
+        uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c5ef8fc5e43..2afe3e8cfa5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -78,7 +78,7 @@ jobs:
           RUN_TESTS: ${{ inputs.RUN_TESTS || env.RUN_TESTS }}
 
       - name: "Checkout"
-        uses: "actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10" # v6.0.3
+        uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v7.0.0
         with:
           fetch-depth: 0 # include all history for GitVersion
           persist-credentials: false
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 6e4acfc0b61..3541d46c08b 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -20,7 +20,7 @@ jobs:
       contents: "read"
     steps:
       - name: "Checkout Repository"
-        uses: "actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10" # v6.0.3
+        uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v7.0.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/image-actions.yml b/.github/workflows/image-actions.yml
index f962eb3f440..621dd429c1c 100644
--- a/.github/workflows/image-actions.yml
+++ b/.github/workflows/image-actions.yml
@@ -36,7 +36,7 @@ jobs:
       contents: "read"
     steps:
       - name: "Checkout Repo"
-        uses: "actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10" # v6.0.3
+        uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v7.0.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml
index bb4ab8aa710..0e2765268f5 100644
--- a/.github/workflows/ossf-scorecard.yml
+++ b/.github/workflows/ossf-scorecard.yml
@@ -29,7 +29,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: "actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10" # v6.0.3
+        uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v7.0.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 221aa95f73f..7e49d504429 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -28,7 +28,7 @@ jobs:
       actions: read          # Only needed for private repos. Needed for upload-sarif to read workflow run info.
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false