diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dd730ed3..4c193e61 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -61,7 +61,7 @@ jobs:
       # the packaged crate read. Changing either is code.
       code: ${{ github.event_name != 'pull_request' || steps.code.outputs.code == 'true' || steps.filter.outputs.readme == 'true' }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       # `code` is false when every changed file is documentation: the same
       # paths the push trigger ignores.
       - uses: dorny/paths-filter@v4
@@ -106,7 +106,7 @@ jobs:
     timeout-minutes: 15
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: rustfmt, clippy
@@ -209,7 +209,7 @@ jobs:
     env:
       UPSTREAM_TAG: v1.5.7
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           # Build + test + header-diff job (no push); don't leave the token
           # in the checkout's git config.
@@ -364,7 +364,7 @@ jobs:
         os: [ubuntu-latest, windows-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         if: needs.changes.outputs.code == 'true'
       - uses: dtolnay/rust-toolchain@stable
         if: needs.changes.outputs.code == 'true'
@@ -422,7 +422,7 @@ jobs:
     timeout-minutes: 15
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: dtolnay/rust-toolchain@stable
       - uses: taiki-e/install-action@nextest
       - name: Install i686 target
@@ -441,7 +441,7 @@ jobs:
     timeout-minutes: 15
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: dtolnay/rust-toolchain@stable
         with:
           toolchain: "1.92.0"
@@ -467,7 +467,7 @@ jobs:
     timeout-minutes: 10
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: clippy
@@ -521,7 +521,7 @@ jobs:
     timeout-minutes: 15
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           # This job builds + tests only (no push); don't leave the token in
           # the checkout's git config.
@@ -616,7 +616,7 @@ jobs:
     timeout-minutes: 30
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: dtolnay/rust-toolchain@stable
         with:
@@ -693,7 +693,7 @@ jobs:
           private-key: ${{ secrets.RELEASER_APP_PRIVATE_KEY }}
 
       - name: Checkout gh-pages with push token
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
           ref: gh-pages
           token: ${{ steps.bot-token.outputs.token }}
@@ -735,7 +735,7 @@ jobs:
     timeout-minutes: 15
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: dtolnay/rust-toolchain@nightly
         with:
           components: llvm-tools-preview
@@ -787,7 +787,7 @@ jobs:
       # corpus replay step and the fresh-fuzz step iterate over this.
       FUZZ_TARGETS: "decode encode interop huff0 fse"
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: dtolnay/rust-toolchain@nightly
       - uses: Swatinem/rust-cache@v2
         with:
@@ -1029,7 +1029,7 @@ jobs:
         bench: ${{ fromJSON(needs.bench-matrix.outputs.targets) }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: dtolnay/rust-toolchain@stable
       - name: Install benchmark target
         run: rustup target add ${{ matrix.bench.target_triple }}
@@ -1127,7 +1127,7 @@ jobs:
         shard: ${{ fromJSON(needs.bench-matrix.outputs.shards) }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         # Needed for: corpus files referenced via `env!("CARGO_MANIFEST_DIR")`
         # inside the bench binary, the run-benchmarks.sh script, and
         # the python post-processor.
@@ -1206,7 +1206,7 @@ jobs:
     timeout-minutes: 10
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - name: Generate bot token
         id: bot-token
@@ -1277,7 +1277,7 @@ jobs:
     timeout-minutes: 20
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - name: Generate bot token
         id: bot-token
@@ -1289,7 +1289,7 @@ jobs:
 
       - name: Checkout gh-pages with push token
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
           ref: gh-pages
           token: ${{ steps.bot-token.outputs.token }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 4bec6861..f3b0205d 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -32,7 +32,7 @@ jobs:
         language: [actions, c-cpp, rust, javascript-typescript]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Initialize CodeQL
diff --git a/.github/workflows/pages-only.yml b/.github/workflows/pages-only.yml
index a796968e..d30b577f 100644
--- a/.github/workflows/pages-only.yml
+++ b/.github/workflows/pages-only.yml
@@ -28,7 +28,7 @@ jobs:
     timeout-minutes: 5
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - name: Generate bot token
         id: bot-token
@@ -38,7 +38,7 @@ jobs:
           private-key: ${{ secrets.RELEASER_APP_PRIVATE_KEY }}
 
       - name: Checkout gh-pages
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
           ref: gh-pages
           token: ${{ steps.bot-token.outputs.token }}
diff --git a/.github/workflows/release-plz.yml b/.github/workflows/release-plz.yml
index 96a8341b..02dc68c0 100644
--- a/.github/workflows/release-plz.yml
+++ b/.github/workflows/release-plz.yml
@@ -27,7 +27,7 @@ jobs:
           private-key: ${{ secrets.RELEASER_APP_PRIVATE_KEY }}
 
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
           token: ${{ steps.app-token.outputs.token }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c99e2846..974c04e0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,7 +12,7 @@ jobs:
     permissions:
       id-token: write
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: dtolnay/rust-toolchain@stable
       - uses: rust-lang/crates-io-auth-action@v1
         id: auth
@@ -39,7 +39,7 @@ jobs:
       contents: read
       id-token: write # npm OIDC trusted publishing + provenance
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           # npm publish authenticates via OIDC, not the checkout token —
           # don't persist it in git config.