diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index db3b364..8258778 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -23,7 +23,7 @@ jobs:
             echo "skip=true" >> $GITHUB_OUTPUT
             echo "Release-please branch — skipping typecheck"
           fi
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
         if: steps.branch-check.outputs.skip != 'true'
       - uses: oven-sh/setup-bun@ecf28ddc73e819eb6fa29df6b34ef8921c743461 # v2
         if: steps.branch-check.outputs.skip != 'true'
@@ -48,7 +48,7 @@ jobs:
             echo "skip=true" >> $GITHUB_OUTPUT
             echo "Release-please branch — skipping lint"
           fi
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
         if: steps.branch-check.outputs.skip != 'true'
       - uses: oven-sh/setup-bun@ecf28ddc73e819eb6fa29df6b34ef8921c743461 # v2
         if: steps.branch-check.outputs.skip != 'true'
@@ -73,7 +73,7 @@ jobs:
             echo "skip=true" >> $GITHUB_OUTPUT
             echo "Release-please branch — skipping tests"
           fi
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
         if: steps.branch-check.outputs.skip != 'true'
         with:
           fetch-depth: 2
@@ -113,7 +113,7 @@ jobs:
         with:
           path: .git
           key: git-folder
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
         if: steps.branch-check.outputs.skip != 'true'
         with:
           fetch-depth: 0
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 115d458..954d010 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -44,7 +44,7 @@ jobs:
 
       # Update bun.lock — release-please bumps package.json versions
       # but does not regenerate the lockfile
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         if: steps.release.outputs.pr && !steps.release.outputs.release_created
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -99,7 +99,7 @@ jobs:
       contents: read
       id-token: write # Required for npm OIDC trusted publishing
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: oven-sh/setup-bun@v2
       - uses: actions/setup-node@v6
         with:
diff --git a/.github/workflows/soop-encode.yml b/.github/workflows/soop-encode.yml
index 2a61b7e..f46d51f 100644
--- a/.github/workflows/soop-encode.yml
+++ b/.github/workflows/soop-encode.yml
@@ -43,7 +43,7 @@ jobs:
           client-id: ${{ secrets.CLIENT_ID }}
           private-key: ${{ secrets.PRIVATE_KEY }}
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
         with:
           fetch-depth: 0
           token: ${{ steps.app-token.outputs.token }}