diff --git a/.github/workflows/forms-cli.yml b/.github/workflows/forms-cli.yml
index 6fb96f145..fe9ec0389 100644
--- a/.github/workflows/forms-cli.yml
+++ b/.github/workflows/forms-cli.yml
@@ -19,7 +19,7 @@ jobs:
         working-directory: support/forms-cli
     steps:
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Determine Ruby version
         id: determine-ruby-version
         run: |
diff --git a/.github/workflows/guardrail_matching_pentester_cidr_blocks.yml b/.github/workflows/guardrail_matching_pentester_cidr_blocks.yml
index 1bf7c1765..33476a8ad 100644
--- a/.github/workflows/guardrail_matching_pentester_cidr_blocks.yml
+++ b/.github/workflows/guardrail_matching_pentester_cidr_blocks.yml
@@ -20,7 +20,7 @@ jobs:
     name: Check for matching CIDR blocks
     steps:
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install `hcl2json` with mise
         uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
diff --git a/.github/workflows/guardrail_tf_version_upgrade.yml b/.github/workflows/guardrail_tf_version_upgrade.yml
index 61cf2ec56..bf815e114 100644
--- a/.github/workflows/guardrail_tf_version_upgrade.yml
+++ b/.github/workflows/guardrail_tf_version_upgrade.yml
@@ -17,7 +17,7 @@ jobs:
     name: Leave a comment
     steps:
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Leave a comment
         env:
diff --git a/.github/workflows/guardrail_unique_job_names.yml b/.github/workflows/guardrail_unique_job_names.yml
index 78c22f1c3..bfd0a942c 100644
--- a/.github/workflows/guardrail_unique_job_names.yml
+++ b/.github/workflows/guardrail_unique_job_names.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     steps:
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Ensure unique job names
         env:
diff --git a/.github/workflows/pipeline-visualiser.yml b/.github/workflows/pipeline-visualiser.yml
index 69e893fe9..f119de75d 100644
--- a/.github/workflows/pipeline-visualiser.yml
+++ b/.github/workflows/pipeline-visualiser.yml
@@ -16,7 +16,7 @@ jobs:
         working-directory: support/pipeline-visualiser
     steps:
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Run docker build
         run: docker build .
@@ -29,7 +29,7 @@ jobs:
         working-directory: support/pipeline-visualiser
     steps:
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Determine Ruby version
         id: determine-ruby-version
         run: |
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 5eab47a57..f37d61ed3 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -18,7 +18,7 @@ jobs:
       pull-requests: write
     steps:
       - name: 📦 Check Out Repository Code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/require-pinned-github-actions.yml b/.github/workflows/require-pinned-github-actions.yml
index 82f5a8f5a..09fb69133 100644
--- a/.github/workflows/require-pinned-github-actions.yml
+++ b/.github/workflows/require-pinned-github-actions.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     steps:
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Ensure SHA pinned actions
         uses: zgosalvez/github-actions-ensure-sha-pinned-actions@3db98c0363e2fa5df3e1c4c471777a7c10b24cc9 # v5.0.5
         with:
diff --git a/.github/workflows/reusable-lint-workflows.yml b/.github/workflows/reusable-lint-workflows.yml
index 7132e1184..edd587587 100644
--- a/.github/workflows/reusable-lint-workflows.yml
+++ b/.github/workflows/reusable-lint-workflows.yml
@@ -7,7 +7,7 @@ jobs:
   actionlint:
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Download actionlint
         id: get_actionlint
         run: |
diff --git a/.github/workflows/reusable-review_apps_on_pr_change.yml b/.github/workflows/reusable-review_apps_on_pr_change.yml
index 20aaa05ee..6eb1c5c30 100644
--- a/.github/workflows/reusable-review_apps_on_pr_change.yml
+++ b/.github/workflows/reusable-review_apps_on_pr_change.yml
@@ -30,7 +30,7 @@ jobs:
         uses: aws-actions/amazon-ecr-login@d539f0932e70871a027e9d5a9d8fc38589180a64 # v2.1.6
 
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Generate container image URI
         id: generate_image_uri
diff --git a/.github/workflows/ruby-ci.yml b/.github/workflows/ruby-ci.yml
index 403ad6212..a1989bcdb 100644
--- a/.github/workflows/ruby-ci.yml
+++ b/.github/workflows/ruby-ci.yml
@@ -22,7 +22,7 @@ jobs:
       spec-matrix: ${{ steps.build-matrix.outputs.spec-matrix }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialise mise and cache `hcl2json`
         uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
@@ -46,7 +46,7 @@ jobs:
     needs: setup
     steps:
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Ruby and gems at root
         uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1.319.0
         with:
@@ -65,7 +65,7 @@ jobs:
         spec_target: ${{ fromJSON(needs.setup.outputs.spec-matrix) }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up hcl2json
         uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
diff --git a/.github/workflows/shell-ci.yml b/.github/workflows/shell-ci.yml
index d4edb7419..9149caec6 100644
--- a/.github/workflows/shell-ci.yml
+++ b/.github/workflows/shell-ci.yml
@@ -9,7 +9,7 @@ jobs:
     name: Shell
     steps:
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Lint shell scripts
         run: |
diff --git a/.github/workflows/terraform-ci.yml b/.github/workflows/terraform-ci.yml
index a07605d5e..72b58e348 100644
--- a/.github/workflows/terraform-ci.yml
+++ b/.github/workflows/terraform-ci.yml
@@ -16,7 +16,7 @@ jobs:
       has-terraform-changes: ${{ steps.check-changes.outputs.has-changes }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # Grab the last 75 commits. Later on we need to a git diff, and it's
           # very likely that two commits involved will be inside the last 75
@@ -133,7 +133,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     steps:
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialise mise
         uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
@@ -156,7 +156,7 @@ jobs:
         directory: ${{ fromJSON(needs.setup.outputs.validation-matrix) }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialise mise
         uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
@@ -181,7 +181,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     steps:
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialise mise
         uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
@@ -214,7 +214,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     steps:
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialise mise
         uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
diff --git a/.github/workflows/update-provider-locks.yml b/.github/workflows/update-provider-locks.yml
index 05674b401..be09429d6 100644
--- a/.github/workflows/update-provider-locks.yml
+++ b/.github/workflows/update-provider-locks.yml
@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # Use the pull request head ref to ensure we're on the PR branch
           ref: ${{ github.head_ref }}