diff --git a/.github/workflows/build-image.yml b/.github/workflows/build-image.yml
index 91628b9..22b6a39 100644
--- a/.github/workflows/build-image.yml
+++ b/.github/workflows/build-image.yml
@@ -104,7 +104,7 @@ jobs:
             runs-on: windows-11-arm   # native Windows-on-ARM runner (FR-004, Principle IV)
     steps:
       - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Validate inputs (pre-flight; fail fast before ADK install / ISO download)
         id: preflight
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 98e9d39..8aebc34 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,7 +24,7 @@ jobs:
     runs-on: windows-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install PowerShell modules (Pester v5 + PSScriptAnalyzer)
         shell: pwsh
diff --git a/.github/workflows/e2e-post-install.yml b/.github/workflows/e2e-post-install.yml
index 22904b1..120ce9a 100644
--- a/.github/workflows/e2e-post-install.yml
+++ b/.github/workflows/e2e-post-install.yml
@@ -37,7 +37,7 @@ jobs:
     runs-on: windows-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Preview every profile (-WhatIf, touches nothing)
         shell: pwsh
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index a92765f..7f7dba0 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -35,7 +35,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Regenerate the catalog manifest from the live module (never drift)
         shell: pwsh