diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 98c45b1..96c27fe 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -37,7 +37,7 @@ jobs:
         language: [python, javascript-typescript]
 
     steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@v7.0.1
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v3
diff --git a/.github/workflows/container_scan.yml b/.github/workflows/container_scan.yml
index 4069d53..6b429eb 100644
--- a/.github/workflows/container_scan.yml
+++ b/.github/workflows/container_scan.yml
@@ -59,7 +59,7 @@ jobs:
   scan:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       # For a code change the published image does not yet contain it, so build
       # the Dockerfile as written. Single architecture is deliberate:
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index ffcfc6a..cf98b30 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -22,7 +22,7 @@ jobs:
         # and datetime.UTC (3.11+).
         python-version: ["3.12", "3.14"]
     steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@v7.0.1
       - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
@@ -34,7 +34,7 @@ jobs:
     name: ruff
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@v7.0.1
       - uses: actions/setup-python@v5
         with:
           python-version: "3.13"
@@ -47,7 +47,7 @@ jobs:
     name: docs match the canonical copy on core
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
       # docs/ is mirrored on core, python and feature/ha-custom-component