diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4a6abf6..83859db 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,7 +12,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - run: node --test --test-concurrency=2 tests/*.test.mjs
diff --git a/CHANGELOG.md b/CHANGELOG.md
index a6912ae..da42750 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 ## Unreleased
 
+- Update CI checkout to v7.0.1 for dependency security fixes and safer fork handling.
+
 - Ignore maintainer opt-in reminders in the comment prefilter so quoted commands do not queue another dispatch. Thanks @SebTardif (#4).
 - Keep comment commands dispatching when the optional target acknowledgement token cannot be minted. Thanks @SebTardif (#5).