diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index b576584..52bcef9 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -24,7 +24,7 @@ jobs:
     env:
       JEKYLL_ENV: production
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml
index f1c3867..0ae4e59 100644
--- a/.github/workflows/preview.yml
+++ b/.github/workflows/preview.yml
@@ -49,7 +49,7 @@ jobs:
           printf 'sha=%s\n' "$(jq -r '.head.sha' "$RUNNER_TEMP/preview-pr.json")" >> "$GITHUB_OUTPUT"
           printf 'number=%s\n' "$PR_NUMBER" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ steps.source.outputs.sha }}
           persist-credentials: false
diff --git a/.github/workflows/refresh-figures.yml b/.github/workflows/refresh-figures.yml
index d0a73b5..81ef3f3 100644
--- a/.github/workflows/refresh-figures.yml
+++ b/.github/workflows/refresh-figures.yml
@@ -34,7 +34,7 @@ jobs:
       BRANCH: automation/refresh-figures
       GH_TOKEN: ${{ github.token }}
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: master