diff --git a/.github/workflows/build-docs.yaml b/.github/workflows/build-docs.yaml
index e308bdb1..1e4aa7b6 100644
--- a/.github/workflows/build-docs.yaml
+++ b/.github/workflows/build-docs.yaml
@@ -18,7 +18,7 @@ jobs:
     runs-on: "ubuntu-24.04"
     name: "generate-docs"
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ inputs.sha }}
           fetch-depth: 0
diff --git a/.github/workflows/build-wheels.yaml b/.github/workflows/build-wheels.yaml
index 180225a6..a8d9f158 100644
--- a/.github/workflows/build-wheels.yaml
+++ b/.github/workflows/build-wheels.yaml
@@ -22,7 +22,7 @@ jobs:
           - rats-devtools
     name: "build-wheels: ${{ matrix.component }}"
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ inputs.sha }}
           fetch-depth: 0
diff --git a/.github/workflows/checks.yaml b/.github/workflows/checks.yaml
index a24d67b5..f898552a 100644
--- a/.github/workflows/checks.yaml
+++ b/.github/workflows/checks.yaml
@@ -23,7 +23,7 @@ jobs:
     runs-on: "ubuntu-24.04"
     name: "check: ${{ matrix.component }}"
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ inputs.sha }}
           fetch-depth: 0
@@ -42,7 +42,7 @@ jobs:
           uv version "$PACKAGE_VERSION"
           rats-ci install check test
       - name: upload-coverage
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           slug: microsoft/rats