diff --git a/.github/workflows/check-fallback-versions.yml b/.github/workflows/check-fallback-versions.yml
index ee23ca7..ca67780 100644
--- a/.github/workflows/check-fallback-versions.yml
+++ b/.github/workflows/check-fallback-versions.yml
@@ -9,7 +9,7 @@ jobs:
     name: "Check baked-in fallback versions are up to date"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v6
         with:
           node-version: 24
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 69d37af..04fe613 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -14,7 +14,7 @@ jobs:
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install 1Password CLI
         uses: ./ # 1password/install-cli-action@<version>
       - name: Check CLI version
@@ -31,7 +31,7 @@ jobs:
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install 1Password CLI
         uses: ./ # 1password/install-cli-action@<version>
         with:
@@ -50,7 +50,7 @@ jobs:
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install 1Password CLI
         uses: ./ # 1password/install-cli-action@<version>
         with:
@@ -69,7 +69,7 @@ jobs:
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install 1Password CLI
         uses: ./ # 1password/install-cli-action@<version>
         with:
@@ -87,7 +87,7 @@ jobs:
           - channel: latest-beta
             versionPath: .CLI2.beta.version
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Capture expected ${{ matrix.channel }} version from app-updates
         id: expected
         run: |
@@ -118,7 +118,7 @@ jobs:
           - channel: latest-beta
             key: latestBeta
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Read expected baked-in ${{ matrix.channel }} version
         id: expected
         run: |