diff --git a/.github/workflows/codecov-checks.yaml b/.github/workflows/codecov-checks.yaml
index 026d35b2b..7146f85c2 100644
--- a/.github/workflows/codecov-checks.yaml
+++ b/.github/workflows/codecov-checks.yaml
@@ -17,7 +17,7 @@ jobs:
       CODECOV_CONFIG_FILE: codecov.yml
       CODECOV_VALIDATE_URL: https://codecov.io/validate
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Validate codecov.yml
         env:
           CURL_OPTS: "--connect-timeout 10 --max-time 30 --retry 3 --retry-all-errors"
diff --git a/.github/workflows/next-container-build.yaml b/.github/workflows/next-container-build.yaml
index 6f71b3480..10276b090 100644
--- a/.github/workflows/next-container-build.yaml
+++ b/.github/workflows/next-container-build.yaml
@@ -25,7 +25,7 @@ jobs:
       packages: write
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/nightly-upgrade-test.yaml b/.github/workflows/nightly-upgrade-test.yaml
index f33f0c649..cd8115463 100644
--- a/.github/workflows/nightly-upgrade-test.yaml
+++ b/.github/workflows/nightly-upgrade-test.yaml
@@ -60,7 +60,7 @@ jobs:
           remove_haskell: true
           rm_cmd: "rmz"
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 # default branch will be checked out by default on scheduled workflows
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 # default branch will be checked out by default on scheduled workflows
         if: ${{ steps.upgrade-path-checker.outputs.SHOULD_BE_SKIPPED_BECAUSE_SAME_BRANCH_OR_DOWNGRADE != 'true' }}
         with:
           ref: ${{ matrix.to_branch }}
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index de00a7c4e..87fdf16db 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -24,7 +24,7 @@ jobs:
     env:
       CONTAINER_TOOL: podman
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ matrix.branch }}
           fetch-depth: 0
diff --git a/.github/workflows/pr-bundle-diff-checks.yaml b/.github/workflows/pr-bundle-diff-checks.yaml
index 3dc2c941b..de8a8127b 100644
--- a/.github/workflows/pr-bundle-diff-checks.yaml
+++ b/.github/workflows/pr-bundle-diff-checks.yaml
@@ -39,7 +39,7 @@ jobs:
         run: rm -rf "${GOMODCACHE:-$HOME/go/pkg/mod}" 
         
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           repository: ${{github.event.pull_request.head.repo.full_name}}
diff --git a/.github/workflows/pr-container-build.yaml b/.github/workflows/pr-container-build.yaml
index 3b4f25800..33ffd9d96 100644
--- a/.github/workflows/pr-container-build.yaml
+++ b/.github/workflows/pr-container-build.yaml
@@ -46,7 +46,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           repository: ${{github.event.pull_request.head.repo.full_name}}
diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml
index 7165280ab..cf3fc59b5 100644
--- a/.github/workflows/pr.yaml
+++ b/.github/workflows/pr.yaml
@@ -28,7 +28,7 @@ jobs:
     needs: authorize
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           repository: ${{github.event.pull_request.head.repo.full_name}}
diff --git a/.github/workflows/renovate-checks.yaml b/.github/workflows/renovate-checks.yaml
index 439e5f2b7..608adac33 100644
--- a/.github/workflows/renovate-checks.yaml
+++ b/.github/workflows/renovate-checks.yaml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Renovate Config Validator
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Print actual renovate version
         # To make sure we are using the latest (not cached) renovate version
         run: |
diff --git a/.github/workflows/scripts-checks.yaml b/.github/workflows/scripts-checks.yaml
index 2e7631d3b..96ba6349f 100644
--- a/.github/workflows/scripts-checks.yaml
+++ b/.github/workflows/scripts-checks.yaml
@@ -24,7 +24,7 @@ jobs:
 
     steps:
       - name: Repository checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           # Differential ShellCheck requires full git history
           fetch-depth: 0
diff --git a/.github/workflows/sync-lightspeed-configs.yaml b/.github/workflows/sync-lightspeed-configs.yaml
index 1b93f31ef..db619e583 100644
--- a/.github/workflows/sync-lightspeed-configs.yaml
+++ b/.github/workflows/sync-lightspeed-configs.yaml
@@ -27,7 +27,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ matrix.branch }}
           fetch-depth: 0
diff --git a/.github/workflows/toml-checks.yaml b/.github/workflows/toml-checks.yaml
index f338f30b8..272eefe35 100644
--- a/.github/workflows/toml-checks.yaml
+++ b/.github/workflows/toml-checks.yaml
@@ -12,7 +12,7 @@ jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: tombi-toml/setup-tombi@9880d1d3ba5e745d410c697366c513b337704388 # v1.0.11
         with:
           version: 'v0.9.9'
diff --git a/.github/workflows/update-rpm-lockfile.yaml b/.github/workflows/update-rpm-lockfile.yaml
index 4242ec58f..9b6a8b9df 100644
--- a/.github/workflows/update-rpm-lockfile.yaml
+++ b/.github/workflows/update-rpm-lockfile.yaml
@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/validate-image-digests.yaml b/.github/workflows/validate-image-digests.yaml
index bbf180517..d32292a84 100644
--- a/.github/workflows/validate-image-digests.yaml
+++ b/.github/workflows/validate-image-digests.yaml
@@ -17,7 +17,7 @@ jobs:
     
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Run validation script
         run: make validate-image-digests