diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d863825..a14a7f3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,7 +11,7 @@ jobs:
   verify:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install pinned uv
         run: curl -LsSf https://astral.sh/uv/0.8.3/install.sh | sh
       - run: uv sync --locked
diff --git a/.github/workflows/scanmaster-example.yml b/.github/workflows/scanmaster-example.yml
index 1576c07..4b52829 100644
--- a/.github/workflows/scanmaster-example.yml
+++ b/.github/workflows/scanmaster-example.yml
@@ -10,7 +10,7 @@ jobs:
   passive-scan:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install pinned uv
         run: curl -LsSf https://astral.sh/uv/0.8.3/install.sh | sh
       - name: Sync locked environment