diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c005265..e45b1c1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,7 +16,7 @@ jobs:
   ci:
     runs-on: ubuntu-latest    # GitHub-hosted: secret-safe + light. Heavy/private nodes move to self-hosted later.
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0      # moon --affected + the gitleaks diff need full history (shallow silently empties the diff)
       - uses: moonrepo/setup-toolchain@261c62cb5b0f580c7be7c8cd0f023a2e96756095 # v0
@@ -34,7 +34,7 @@ jobs:
   secrets:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       # The gitleaks GitHub Action (v2) is license-walled for orgs; the gitleaks
diff --git a/.github/workflows/parity-live.yml b/.github/workflows/parity-live.yml
index 1bf3d3d..d52fd23 100644
--- a/.github/workflows/parity-live.yml
+++ b/.github/workflows/parity-live.yml
@@ -17,7 +17,7 @@ jobs:
   parity-live:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: moonrepo/setup-toolchain@261c62cb5b0f580c7be7c8cd0f023a2e96756095 # v0
         with:
           auto-install: true