diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6c974db..dbb3d81 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,7 +18,7 @@ jobs:
         with:
           egress-policy: audit  # advisory: logs egress without blocking. Flip to 'block' once the allowed-endpoints list is pinned from audit output.
 
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install PSScriptAnalyzer
         shell: pwsh
@@ -252,7 +252,7 @@ jobs:
         with:
           egress-policy: audit  # advisory: logs egress without blocking. Flip to 'block' once the allowed-endpoints list is pinned from audit output.
 
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Validate JSON configs parse correctly
         shell: pwsh
@@ -493,7 +493,7 @@ jobs:
         with:
           egress-policy: audit  # advisory: logs egress without blocking. Flip to 'block' once the allowed-endpoints list is pinned from audit output.
 
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Run functional profile tests
         shell: pwsh