diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index ec133c9..d11bdeb 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -3,16 +3,23 @@
 # Docs: https://gh.io/actions-lockfile
 version: 'v0.0.2'
 workflows:
+    '.github/workflows/codeql.yml':
+        - 'actions/checkout@v7.0.1'
     '.github/workflows/governance.yml': []
     '.github/workflows/hypatia-scan.yml': []
     '.github/workflows/label-triage.yml': []
     '.github/workflows/labels.yml': []
-    '.github/workflows/secret-scanner.yml': []
     '.github/workflows/push-email-notify.yml':
-        - 'hyperpolymath/smtp-notify-action@v0.1.0'
+        - 'hyperpolymath/smtp-notify-action@v0.3.0'
+    '.github/workflows/secret-scanner.yml': []
 dependencies:
-    'hyperpolymath/smtp-notify-action@v0.1.0':
-        ref: 'v0.1.0'
-        commit: 'sha1-1b3b752d39a4fe4c0f28f10905e4608789d3e050'
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'hyperpolymath/smtp-notify-action@v0.3.0':
+        ref: 'v0.3.0'
+        commit: 'sha1-22e7bdb322c430c1d0dac6b3bb307f4bb139d0be'
         owner_id: 6759885
         repo_id: 1352485172
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index e1b3498..c354e6b 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 name: CodeQL
 
@@ -30,7 +31,7 @@ jobs:
             build-mode: none
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+        uses: actions/checkout@v7.0.1
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@29b1f65c1f735799893313399435a59f54045865 # v3
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index f33964f..d2e2735 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 name: Governance
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index f684ec7..427e5f1 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 name: Hypatia Security Scan
diff --git a/.github/workflows/label-triage.yml b/.github/workflows/label-triage.yml
index 9886e92..814a192 100644
--- a/.github/workflows/label-triage.yml
+++ b/.github/workflows/label-triage.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 name: Label Triage
 
diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index c80b676..83ab941 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 name: Labels
 
diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml
index 53cfeab..233fe4e 100644
--- a/.github/workflows/push-email-notify.yml
+++ b/.github/workflows/push-email-notify.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # Dormant push-email notification. ARMED by setting the repo variable
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 07dd1d2..bb2fed1 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 # Calls the estate's shared secret scanner (gitleaks + rust-secrets +