diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e0976cc..7e908d0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,7 +25,7 @@ jobs:
           - "3.12"
           - "3.13"
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -57,7 +57,7 @@ jobs:
     name: Reproducible distributions
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
diff --git a/.github/workflows/dependency-audit.yml b/.github/workflows/dependency-audit.yml
index 7821caf..b3f522a 100644
--- a/.github/workflows/dependency-audit.yml
+++ b/.github/workflows/dependency-audit.yml
@@ -18,7 +18,7 @@ jobs:
       matrix:
         python-version: ["3.10", "3.13"]
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index ad2e33d..fe523dd 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -25,7 +25,7 @@ jobs:
     name: Build Pages artifact
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 8306e82..fb479b1 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -16,7 +16,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -86,7 +86,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -211,7 +211,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.sha }}
           persist-credentials: false
@@ -238,7 +238,7 @@ jobs:
       matrix:
         python-version: ["3.10", "3.13"]
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.sha }}
           persist-credentials: false
diff --git a/.github/workflows/repository-hardening.yml b/.github/workflows/repository-hardening.yml
index f9751be..1f670f3 100644
--- a/.github/workflows/repository-hardening.yml
+++ b/.github/workflows/repository-hardening.yml
@@ -21,7 +21,7 @@ jobs:
   hosted-drift:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Check hosted repository hardening
diff --git a/tests/test_repository_hardening.py b/tests/test_repository_hardening.py
index 6854844..213262e 100644
--- a/tests/test_repository_hardening.py
+++ b/tests/test_repository_hardening.py
@@ -259,7 +259,7 @@ def test_publish_workflow_revalidates_the_exact_tagged_commit() -> None:
     publish_job = workflow.split("  publish:", 1)[1].split("  release:", 1)[0]
 
     assert "needs: build" in validate_job
-    assert "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" in validate_job
+    assert "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1" in validate_job
     assert "persist-credentials: false" in validate_job
     assert "python -m pip install --require-hashes -r requirements-build.txt" in validate_job
     assert "python -m pip install --require-hashes -r requirements.txt" in validate_job
@@ -347,7 +347,7 @@ def test_publish_workflow_keeps_package_check_out_of_build_job() -> None:
     assert "twine==6.2.0" not in build_job
     assert "twine check dist/*" not in build_job
     assert "python -m build --no-isolation" in build_job
-    assert "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" in check_and_publish
+    assert "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1" in check_and_publish
     assert "persist-credentials: false" in check_and_publish
     assert (
         "python -m pip install --require-hashes -r requirements.txt"