diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml
index 7fd255f..f94dc0e 100644
--- a/.github/workflows/ci-cd.yml
+++ b/.github/workflows/ci-cd.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-24.04-arm                # free arm64 runner (public repo); matches prod arch
     container: swift:6.3-amazonlinux2023     # exact prod toolchain — same image scripts/build.sh uses; already bundles git + openssl-devel
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: swift test
         run: swift test
 
@@ -25,7 +25,7 @@ jobs:
     name: Python converter tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.14"         # matches converter Lambda runtime
@@ -48,7 +48,7 @@ jobs:
       group: deploy-nzimageapi           # serialize deploys; never overlap
       cancel-in-progress: false
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6
         with:
           role-to-assume: ${{ secrets.AWS_ROLE_ARN }}