diff --git a/.github/workflows/hol-plugin-scanner.yml b/.github/workflows/hol-plugin-scanner.yml
index 931f2dc..566b8f3 100644
--- a/.github/workflows/hol-plugin-scanner.yml
+++ b/.github/workflows/hol-plugin-scanner.yml
@@ -14,7 +14,7 @@ jobs:
   scan:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: HOL Plugin Scanner
         uses: hashgraph-online/ai-plugin-scanner-action@0917cc4252a9dcd776501475e3865d5a334d6593 # v1
diff --git a/.github/workflows/mcp-registry.yml b/.github/workflows/mcp-registry.yml
index 4953d8a..b783346 100644
--- a/.github/workflows/mcp-registry.yml
+++ b/.github/workflows/mcp-registry.yml
@@ -26,7 +26,7 @@ jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Install mcp-publisher
         run: |
diff --git a/.github/workflows/plugin-checks.yml b/.github/workflows/plugin-checks.yml
index 613da39..c80013d 100644
--- a/.github/workflows/plugin-checks.yml
+++ b/.github/workflows/plugin-checks.yml
@@ -13,7 +13,7 @@ jobs:
   package:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Validate package metadata
         run: python3 scripts/check-plugin-package.py .