diff --git a/.github/workflows/release-gates.yml b/.github/workflows/release-gates.yml
index 4582750..2455fac 100644
--- a/.github/workflows/release-gates.yml
+++ b/.github/workflows/release-gates.yml
@@ -29,7 +29,7 @@ jobs:
 
     steps:
       - name: Check out source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index 0ef1549..7369571 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: Check out full history
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/Tests/DevScopeCoreTests/ReleaseScriptTests.swift b/Tests/DevScopeCoreTests/ReleaseScriptTests.swift
index d8fb04a..1599ba8 100644
--- a/Tests/DevScopeCoreTests/ReleaseScriptTests.swift
+++ b/Tests/DevScopeCoreTests/ReleaseScriptTests.swift
@@ -968,9 +968,9 @@ final class ReleaseScriptTests: XCTestCase {
     let source = try appSource(at: ".github/workflows/release-gates.yml")
 
     XCTAssertTrue(
-      source.contains("actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd")
+      source.contains("actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1")
     )
-    XCTAssertFalse(source.contains("actions/checkout@v6"))
+    XCTAssertFalse(source.contains("actions/checkout@v7"))
   }
 
   func testOpenSourceReadinessCheckerRejectsRepositoryWithoutLicense() throws {