diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 08f33ba..1449c27 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -103,7 +103,7 @@ jobs:
     # under bead `ley-line-open-f10abb`. See bead `mache-802d2b`.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           lfs: true
 
diff --git a/.github/workflows/lfs-guard.yml b/.github/workflows/lfs-guard.yml
index 1dfaaff..651f32f 100644
--- a/.github/workflows/lfs-guard.yml
+++ b/.github/workflows/lfs-guard.yml
@@ -29,7 +29,7 @@ jobs:
     name: assert .gitattributes adds no filter=lfs
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           # Explicit `lfs: false` so this job can run even when the org