diff --git a/.github/workflows/reusable-agent-restricted.yml b/.github/workflows/reusable-agent-restricted.yml
index 72f48e2..5cb0362 100644
--- a/.github/workflows/reusable-agent-restricted.yml
+++ b/.github/workflows/reusable-agent-restricted.yml
@@ -137,7 +137,7 @@ jobs:
       # own files in the workspace. The strands-action composite and its runner scripts are NOT
       # taken from here — they're bundled with the centrally-hosted action in the devtools repo.
       - name: Checkout caller repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ github.repository }}
           ref: ${{ github.sha }}
diff --git a/.github/workflows/reusable-ci-failure-issue.yml b/.github/workflows/reusable-ci-failure-issue.yml
index db1cc43..2f6d658 100644
--- a/.github/workflows/reusable-ci-failure-issue.yml
+++ b/.github/workflows/reusable-ci-failure-issue.yml
@@ -34,7 +34,7 @@ jobs:
     permissions:
       issues: write
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: '20.x'
diff --git a/.github/workflows/reusable-pr-automerge.yml b/.github/workflows/reusable-pr-automerge.yml
index 660f853..251858c 100644
--- a/.github/workflows/reusable-pr-automerge.yml
+++ b/.github/workflows/reusable-pr-automerge.yml
@@ -52,7 +52,7 @@ jobs:
     steps:
       # Checkout is only needed for the filesystem-detection fallback. Fetch a shallow tree.
       - name: Checkout (for language detection)
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 1
diff --git a/.github/workflows/reusable-pr-labeler.yml b/.github/workflows/reusable-pr-labeler.yml
index bd3d57e..fbff8e5 100644
--- a/.github/workflows/reusable-pr-labeler.yml
+++ b/.github/workflows/reusable-pr-labeler.yml
@@ -46,7 +46,7 @@ jobs:
       # let actions/labeler resolve it from the workspace. Under
       # pull_request_target this checks out the base ref, NOT the untrusted PR head.
       - name: Checkout code
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Resolve the labeler config path (consumers use the v5+ `changed-files:` schema).
       - name: Detect labeler config
diff --git a/.github/workflows/reusable-strands-command.yml b/.github/workflows/reusable-strands-command.yml
index 3c4819f..d31a8b3 100644
--- a/.github/workflows/reusable-strands-command.yml
+++ b/.github/workflows/reusable-strands-command.yml
@@ -95,7 +95,7 @@ jobs:
           exit 1
 
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/reusable-sync-from-public.yml b/.github/workflows/reusable-sync-from-public.yml
index 9006603..f6595e8 100644
--- a/.github/workflows/reusable-sync-from-public.yml
+++ b/.github/workflows/reusable-sync-from-public.yml
@@ -91,7 +91,7 @@ jobs:
           app-id: ${{ vars.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
 
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           token: ${{ steps.app-token.outputs.token }}