diff --git a/.github/workflows/analyze-github-actions.yaml b/.github/workflows/analyze-github-actions.yaml
index da5041b..9aff3a6 100644
--- a/.github/workflows/analyze-github-actions.yaml
+++ b/.github/workflows/analyze-github-actions.yaml
@@ -15,7 +15,7 @@ jobs:
       actions: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/chart-values.yaml b/.github/workflows/chart-values.yaml
index 186931b..7023283 100644
--- a/.github/workflows/chart-values.yaml
+++ b/.github/workflows/chart-values.yaml
@@ -12,7 +12,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/cluster-values-validation.yaml b/.github/workflows/cluster-values-validation.yaml
index 546d448..d8642ae 100644
--- a/.github/workflows/cluster-values-validation.yaml
+++ b/.github/workflows/cluster-values-validation.yaml
@@ -14,7 +14,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set up Helm
         run: |
@@ -31,7 +31,7 @@ jobs:
           echo "${HOME}/go/bin" >> $GITHUB_PATH
 
       - name: Checkout GiantSwarm Releases repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: giantswarm/releases
           path: releases
diff --git a/.github/workflows/create-release-pr.yaml b/.github/workflows/create-release-pr.yaml
index fb7a5c3..b83e5a8 100644
--- a/.github/workflows/create-release-pr.yaml
+++ b/.github/workflows/create-release-pr.yaml
@@ -143,7 +143,7 @@ jobs:
       - gather_facts
     if: ${{ needs.gather_facts.outputs.skip != 'true' && github.repository == 'giantswarm/backstage' }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ needs.gather_facts.outputs.branch }}
           persist-credentials: false
@@ -198,7 +198,7 @@ jobs:
           version: v8.2.1
           download_url: "https://github.com/giantswarm/architect/releases/download/${version}/architect-linux-amd64"
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ needs.gather_facts.outputs.branch }}
           persist-credentials: false
diff --git a/.github/workflows/create-release.yaml b/.github/workflows/create-release.yaml
index cdae99c..b4ee0ed 100644
--- a/.github/workflows/create-release.yaml
+++ b/.github/workflows/create-release.yaml
@@ -63,7 +63,7 @@ jobs:
           echo "version=${version}" >> $GITHUB_OUTPUT
       - name: Checkout code
         if: ${{ steps.get_version.outputs.version != '' }}
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Get project.go path
         id: get_project_go_path
         if: ${{ steps.get_version.outputs.version != '' }}
@@ -116,7 +116,7 @@ jobs:
           tarball_binary_path: "*/src/${binary}"
           smoke_test: "${binary} --version"
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - name: Update project.go
@@ -184,7 +184,7 @@ jobs:
       upload_url: ${{ steps.create_gh_release.outputs.upload_url }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ github.sha }}
           persist-credentials: false
@@ -271,7 +271,7 @@ jobs:
           tarball_binary_path: "*/src/${binary}"
           smoke_test: "${binary} --version"
       - name: Check out the repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0 # Clone the whole history, not just the most recent commit.
       - name: Fetch all tags and branches
@@ -359,7 +359,7 @@ jobs:
         with:
           go-version: ${{ env.GO_VERSION }}
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ env.TAG }}
           # Strings ('0' / '1') are required because the GHA ternary idiom
diff --git a/.github/workflows/documentation-validation.yaml b/.github/workflows/documentation-validation.yaml
index fbf47ca..e1eacfa 100644
--- a/.github/workflows/documentation-validation.yaml
+++ b/.github/workflows/documentation-validation.yaml
@@ -23,7 +23,7 @@ jobs:
         with:
           go-version: ${{ env.GO_VERSION }}
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: "Run 'make generate-docs' and check for differences"
         run: |
           make generate-docs
diff --git a/.github/workflows/ensure-major-version-tags.yaml b/.github/workflows/ensure-major-version-tags.yaml
index 9c86a43..19cf193 100644
--- a/.github/workflows/ensure-major-version-tags.yaml
+++ b/.github/workflows/ensure-major-version-tags.yaml
@@ -21,5 +21,5 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: giantswarm/floating-tags-action@ce8d4d60ddeaf45623e82954987f1644775db3f1 # v1.2.0
diff --git a/.github/workflows/fix-vulnerabilities.yaml b/.github/workflows/fix-vulnerabilities.yaml
index 3604f77..e937ce4 100644
--- a/.github/workflows/fix-vulnerabilities.yaml
+++ b/.github/workflows/fix-vulnerabilities.yaml
@@ -38,7 +38,7 @@ jobs:
       skip: ${{ steps.gather_facts.outputs.skip }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ inputs.branch || github.ref }}
       - name: Gather facts
@@ -78,7 +78,7 @@ jobs:
           private-key: ${{ secrets.HERALD_APP_KEY }}
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           token: ${{ steps.generate_token.outputs.token }}
           persist-credentials: false
diff --git a/.github/workflows/gitleaks.yaml b/.github/workflows/gitleaks.yaml
index 8ae0486..f42c43e 100644
--- a/.github/workflows/gitleaks.yaml
+++ b/.github/workflows/gitleaks.yaml
@@ -11,7 +11,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: '0'
       - name: gitleaks-action
diff --git a/.github/workflows/go-coverage.yaml b/.github/workflows/go-coverage.yaml
index 94b5cde..1858c8a 100644
--- a/.github/workflows/go-coverage.yaml
+++ b/.github/workflows/go-coverage.yaml
@@ -23,7 +23,7 @@ jobs:
       contents: write
     steps:
       - name: Clone repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           # default fetch-depth is insufficent to find previous coverage notes
           fetch-depth: 10
diff --git a/.github/workflows/helm-render-diff.yaml b/.github/workflows/helm-render-diff.yaml
index 45ed975..30b3cc0 100644
--- a/.github/workflows/helm-render-diff.yaml
+++ b/.github/workflows/helm-render-diff.yaml
@@ -46,7 +46,7 @@ jobs:
       pull-requests: write
     if: github.event_name == 'pull_request' && needs.check-cmp-state.outputs.suspend_comment_id == 0 && needs.check-cmp-state.outputs.suspend_diffs_printing_from_pr_body == 'false'
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: install helm
         uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
         with:
@@ -84,7 +84,7 @@ jobs:
               -f "${test_file_path}" \
               "helm/${REPO_NAME}" > "/tmp/${test_file_path}/render-new.yaml"
           done
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: "${{ github.event.repository.default_branch }}"
           path: 'old'
diff --git a/.github/workflows/js-dependency-audit.yaml b/.github/workflows/js-dependency-audit.yaml
index 3d4d2ab..f3016bf 100644
--- a/.github/workflows/js-dependency-audit.yaml
+++ b/.github/workflows/js-dependency-audit.yaml
@@ -196,12 +196,12 @@ jobs:
           chmod +x /tmp/audit.sh
 
       - name: Checkout PR head
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
       - name: Checkout base branch
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ github.event.pull_request.base.sha }}
           path: _base_audit_ref
diff --git a/.github/workflows/json-schema-validation.yaml b/.github/workflows/json-schema-validation.yaml
index 0664d47..fbc480f 100644
--- a/.github/workflows/json-schema-validation.yaml
+++ b/.github/workflows/json-schema-validation.yaml
@@ -18,7 +18,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Run schemalint
         id: run-schemalint
         uses: giantswarm/schemalint/actions/verify-helm-schema@5d64fa08da5ef5d593b0298a1ebb6c0e02dfa0b6 # v2.6.1
@@ -31,7 +31,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Run helm-values-gen
         id: run-helm-values-gen
diff --git a/.github/workflows/ossf-scorecard.yaml b/.github/workflows/ossf-scorecard.yaml
index 1e2e654..191441d 100644
--- a/.github/workflows/ossf-scorecard.yaml
+++ b/.github/workflows/ossf-scorecard.yaml
@@ -33,7 +33,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/publish-techdocs.yaml b/.github/workflows/publish-techdocs.yaml
index 0f12090..24fc4e1 100644
--- a/.github/workflows/publish-techdocs.yaml
+++ b/.github/workflows/publish-techdocs.yaml
@@ -32,7 +32,7 @@ jobs:
           node-version: '24'
 
       - name: Clone source repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Cache dependencies
         id: cache-npm
diff --git a/.github/workflows/sync-from-upstream.yaml b/.github/workflows/sync-from-upstream.yaml
index 9f0b6ac..160e0ee 100644
--- a/.github/workflows/sync-from-upstream.yaml
+++ b/.github/workflows/sync-from-upstream.yaml
@@ -32,7 +32,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
       - name: Prepare update branch
@@ -78,7 +78,7 @@ jobs:
           client-id: ${{ secrets.HERALD_CLIENT_ID }}
           private-key: ${{ secrets.HERALD_APP_KEY }}
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ inputs.update_branch }}
           token: ${{ steps.generate_token.outputs.token }}
diff --git a/.github/workflows/update-action-version.yaml b/.github/workflows/update-action-version.yaml
index 05ac74a..46f303b 100644
--- a/.github/workflows/update-action-version.yaml
+++ b/.github/workflows/update-action-version.yaml
@@ -70,7 +70,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ needs.get_version.outputs.branch }}
           persist-credentials: false
diff --git a/.github/workflows/update-chart.yaml b/.github/workflows/update-chart.yaml
index d79817c..30a5e2e 100644
--- a/.github/workflows/update-chart.yaml
+++ b/.github/workflows/update-chart.yaml
@@ -78,7 +78,7 @@ jobs:
     if: ${{ needs.gather_facts.outputs.skip != 'true' }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ needs.gather_facts.outputs.branch }}
       - name: Install vendir
diff --git a/.github/workflows/validate-changelog.yaml b/.github/workflows/validate-changelog.yaml
index 4fa84f1..84a2f96 100644
--- a/.github/workflows/validate-changelog.yaml
+++ b/.github/workflows/validate-changelog.yaml
@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
diff --git a/.github/workflows/validate-file-names.yaml b/.github/workflows/validate-file-names.yaml
index 8b642dd..cfb24a8 100644
--- a/.github/workflows/validate-file-names.yaml
+++ b/.github/workflows/validate-file-names.yaml
@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/validate-workflows.yaml b/.github/workflows/validate-workflows.yaml
index f8d589d..4ba9814 100644
--- a/.github/workflows/validate-workflows.yaml
+++ b/.github/workflows/validate-workflows.yaml
@@ -15,7 +15,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Validate YAML
         run: |