diff --git a/.github/workflows/dupdetect-test.yml b/.github/workflows/dupdetect-test.yml
index 9a3dce6..164bd5b 100644
--- a/.github/workflows/dupdetect-test.yml
+++ b/.github/workflows/dupdetect-test.yml
@@ -30,7 +30,7 @@ jobs:
     steps:
       # SHA-pinned per the ACTION PINNING POLICY in pr-review-dispatch.yml's
       # header (the canonical statement; lint.yml cites it the same way).
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: tools/dupdetect/go.mod
diff --git a/.github/workflows/duplicate-detect.yml b/.github/workflows/duplicate-detect.yml
index 25fd570..b0c46a3 100644
--- a/.github/workflows/duplicate-detect.yml
+++ b/.github/workflows/duplicate-detect.yml
@@ -53,7 +53,7 @@ jobs:
       # header. Worth restating the stake HERE and nowhere else: this job runs
       # under pull_request_target holding issues:write and pull-requests:write
       # on the base repo, so a moved tag would execute with those scopes.
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index 11d02f2..0265c92 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -25,4 +25,4 @@ jobs:
   label:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
+      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 46d21ee..eb92e8a 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -33,7 +33,7 @@ jobs:
     steps:
       # SHA-pinned per the repo-wide policy documented in
       # pr-review-dispatch.yml's header.
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/pr-review-dispatch.yml b/.github/workflows/pr-review-dispatch.yml
index ed28bb7..9900bb6 100644
--- a/.github/workflows/pr-review-dispatch.yml
+++ b/.github/workflows/pr-review-dispatch.yml
@@ -94,7 +94,7 @@ jobs:
       - name: Check out workflow scripts
         # Checks out the default branch (the privileged ref this workflow
         # already runs as), NOT the PR head. Only `.github/scripts` is used.
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -188,7 +188,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Check out workflow scripts
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/root-test.yml b/.github/workflows/root-test.yml
index 8bbee66..ae04566 100644
--- a/.github/workflows/root-test.yml
+++ b/.github/workflows/root-test.yml
@@ -72,7 +72,7 @@ jobs:
     steps:
       # SHA-pinned per the ACTION PINNING POLICY in pr-review-dispatch.yml's
       # header (the canonical statement; lint.yml cites it the same way).
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod