diff --git a/.github/workflows/build-dbt-oss-musllinux.yml b/.github/workflows/build-dbt-oss-musllinux.yml
index 6c8e9b8..6707ce3 100644
--- a/.github/workflows/build-dbt-oss-musllinux.yml
+++ b/.github/workflows/build-dbt-oss-musllinux.yml
@@ -69,7 +69,7 @@ jobs:
       upstream_sha: ${{ steps.checkout_verify.outputs.sha }}
     steps:
       - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Cache cargo + sccache
         if: github.event_name != 'workflow_dispatch'
diff --git a/.github/workflows/build-dbt-oss-win-arm64.yml b/.github/workflows/build-dbt-oss-win-arm64.yml
index dfc3b50..e42c632 100644
--- a/.github/workflows/build-dbt-oss-win-arm64.yml
+++ b/.github/workflows/build-dbt-oss-win-arm64.yml
@@ -54,7 +54,7 @@ jobs:
           "sha=$sha" >> $env:GITHUB_OUTPUT
 
       - name: Checkout dbt-oss at resolved commit
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: dbt-labs/dbt-oss
           ref: ${{ steps.upstream.outputs.sha }}
diff --git a/.github/workflows/build-environment-image.yml b/.github/workflows/build-environment-image.yml
index 77b32e6..6d20112 100644
--- a/.github/workflows/build-environment-image.yml
+++ b/.github/workflows/build-environment-image.yml
@@ -36,7 +36,7 @@ jobs:
       attestations: write
     steps:
       - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Compute recipe tag
         id: tag
diff --git a/.github/workflows/merge-bot.yml b/.github/workflows/merge-bot.yml
index b26640f..b018f59 100644
--- a/.github/workflows/merge-bot.yml
+++ b/.github/workflows/merge-bot.yml
@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
@@ -48,7 +48,7 @@ jobs:
       HEAD_SHA: ${{ github.event.pull_request.head.sha }}
     steps:
       - name: Checkout full history at PR head
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.sha }}
diff --git a/.github/workflows/pages-deployment.yml b/.github/workflows/pages-deployment.yml
index f9d4022..34dd00c 100644
--- a/.github/workflows/pages-deployment.yml
+++ b/.github/workflows/pages-deployment.yml
@@ -23,7 +23,7 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
diff --git a/.github/workflows/policy-ci.yml b/.github/workflows/policy-ci.yml
index 60b4f34..b45b7ad 100644
--- a/.github/workflows/policy-ci.yml
+++ b/.github/workflows/policy-ci.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
diff --git a/.github/workflows/release-policy.yml b/.github/workflows/release-policy.yml
index 6613577..b0f55b1 100644
--- a/.github/workflows/release-policy.yml
+++ b/.github/workflows/release-policy.yml
@@ -46,7 +46,7 @@ jobs:
       SIGNER_ISSUER: ${{ vars.POLICY_SIGNER_ISSUER }}
     steps:
       - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
@@ -130,7 +130,7 @@ jobs:
       WANT: ${{ inputs.policy_version }}
     steps:
       - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/smoke-test-win-arm64.yml b/.github/workflows/smoke-test-win-arm64.yml
index 8a1f7d0..c4c10cd 100644
--- a/.github/workflows/smoke-test-win-arm64.yml
+++ b/.github/workflows/smoke-test-win-arm64.yml
@@ -13,7 +13,7 @@ jobs:
   probe:
     runs-on: windows-11-arm
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: System info
         shell: pwsh
diff --git a/.github/workflows/verify-and-release.yml b/.github/workflows/verify-and-release.yml
index ffd466e..0a7924f 100644
--- a/.github/workflows/verify-and-release.yml
+++ b/.github/workflows/verify-and-release.yml
@@ -81,7 +81,7 @@ jobs:
       # checkout keeps this fast and means a change anywhere else in the
       # repo can't accidentally affect what this job checks out.
       - name: Checkout scripts
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0