diff --git a/.github/actions/publish/action.yml b/.github/actions/publish/action.yml
index 7a467e4..a18b332 100644
--- a/.github/actions/publish/action.yml
+++ b/.github/actions/publish/action.yml
@@ -11,7 +11,7 @@ runs:
     # see https://github.com/google-github-actions/release-please-action#automating-publication-to-npm
     # see https://docs.npmjs.com/generating-provenance-statements
     - name: Checkout Repository
-      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
         persist-credentials: false
     - name: Setup Node.js
diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml
index 4d6a774..265435b 100644
--- a/.github/workflows/commitlint.yml
+++ b/.github/workflows/commitlint.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - uses: ./.github/actions/prepare
diff --git a/.github/workflows/nodejs.yml b/.github/workflows/nodejs.yml
index 3efa31b..8221ac6 100644
--- a/.github/workflows/nodejs.yml
+++ b/.github/workflows/nodejs.yml
@@ -22,7 +22,7 @@ jobs:
           - node-version: '24'
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - uses: ./.github/actions/prepare
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 4de2bff..a2dd3da 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -23,7 +23,7 @@ jobs:
         run: echo "NPM_TOKEN is not set"
       - if: ${{ env.token != '' }}
         name: Checkout Repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - if: ${{ env.token != '' }}