diff --git a/.github/workflows/release.yml.template b/.github/workflows/release.yml.template
index 4254324..cc0c978 100644
--- a/.github/workflows/release.yml.template
+++ b/.github/workflows/release.yml.template
@@ -32,7 +32,7 @@ jobs:
           - target: aarch64-apple-darwin
             os: macos-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7.0.1
       - uses: dtolnay/rust-toolchain@stable
         with:
           targets: ${{ matrix.target }}
@@ -92,7 +92,7 @@ jobs:
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/')
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7.0.1
       - uses: dtolnay/rust-toolchain@stable
       # --locked keeps the committed Cargo.lock so the publish
       # verification step cannot fail the dirty-git-state check by