diff --git a/.github/workflows/model-smoke.yml b/.github/workflows/model-smoke.yml
index 799865c..c863fa0 100644
--- a/.github/workflows/model-smoke.yml
+++ b/.github/workflows/model-smoke.yml
@@ -55,7 +55,7 @@ jobs:
     env:
       BRIDGE_TOKEN: test-only-bridge-token-never-use-in-production
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Prepare disposable cache
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index b938f71..ee1c029 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -33,7 +33,7 @@ jobs:
       BRIDGE_PHP_IMAGE: ${{ matrix.image }}
       EXPECTED_PHP: ${{ matrix.php }}
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Inspect sandbox configuration
@@ -63,7 +63,7 @@ jobs:
     env:
       BRIDGE_TOKEN: test-only-bridge-token-never-use-in-production
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Prepare disposable cache