diff --git a/.github/workflows/gc-cron.yaml b/.github/workflows/gc-cron.yaml
index 971d37b..3c67c38 100644
--- a/.github/workflows/gc-cron.yaml
+++ b/.github/workflows/gc-cron.yaml
@@ -18,7 +18,7 @@ jobs:
       stacks: ${{ steps.list_stacks.outputs.stacks_list }}
     steps:
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
@@ -58,7 +58,7 @@ jobs:
       OS_IDENTITY_API_VERSION: "3"
     steps:
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
diff --git a/.github/workflows/platform-test.yaml b/.github/workflows/platform-test.yaml
index dda0f40..04b3cad 100644
--- a/.github/workflows/platform-test.yaml
+++ b/.github/workflows/platform-test.yaml
@@ -49,7 +49,7 @@ jobs:
       OS_PASSWORD: ${{ secrets.OS_PASSWORD }}
     steps:
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # NOTE: Needed whatever the provider, the stacks living in an S3 bucket
       - name: Configure AWS credentials
@@ -82,7 +82,7 @@ jobs:
       OS_PASSWORD: ${{ secrets.OS_PASSWORD }}
     steps:
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
diff --git a/.github/workflows/pre-merge.yaml b/.github/workflows/pre-merge.yaml
index d5fea47..7331751 100644
--- a/.github/workflows/pre-merge.yaml
+++ b/.github/workflows/pre-merge.yaml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Setup Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
diff --git a/.github/workflows/promote.yaml b/.github/workflows/promote.yaml
index 2e30690..b91c276 100644
--- a/.github/workflows/promote.yaml
+++ b/.github/workflows/promote.yaml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # NOTE: We explicitly set the refs otherwise the tag
           # annotations content is not fetched
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 9d76d87..a48087b 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -36,7 +36,7 @@ jobs:
           app-id: ${{ vars.ACTIONS_APP_ID }}
           private-key: ${{ secrets.ACTIONS_APP_PRIVATE_KEY }}
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           token: ${{ steps.app-token.outputs.token }}
diff --git a/.github/workflows/snapshot-test.yaml b/.github/workflows/snapshot-test.yaml
index f26a76a..a5d7804 100644
--- a/.github/workflows/snapshot-test.yaml
+++ b/.github/workflows/snapshot-test.yaml
@@ -43,7 +43,7 @@ jobs:
       OS_PASSWORD: ${{ secrets.OS_PASSWORD }}
     steps:
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # NOTE: Needed whatever the provider, the stacks living in an S3 bucket
       - name: Configure AWS credentials
@@ -136,7 +136,7 @@ jobs:
       OS_PASSWORD: ${{ secrets.OS_PASSWORD }}
     steps:
       - name: Checkout
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1