diff --git a/.github/workflows/airgapped.yaml b/.github/workflows/airgapped.yaml
index 228fd5cd..be2175f6 100644
--- a/.github/workflows/airgapped.yaml
+++ b/.github/workflows/airgapped.yaml
@@ -51,7 +51,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: release-state
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # check-versions.sh resolves the SDK version from the newest
           # component/* tag, so a shallow clone without tags would report drift.
@@ -84,7 +84,7 @@ jobs:
     outputs:
       pending: ${{ steps.state.outputs.pending }}
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # The PR merge commit's first parent, for the changed-files check.
           fetch-depth: 2
@@ -137,7 +137,7 @@ jobs:
     outputs:
       modules: ${{ steps.modules.outputs.modules }}
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Discover modules
         id: modules
@@ -193,7 +193,7 @@ jobs:
       matrix:
         module: ${{ fromJSON(needs.image.outputs.modules) }}
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -230,7 +230,7 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Resolve image name and tag
         id: img
diff --git a/.github/workflows/bench.yml b/.github/workflows/bench.yml
index ea70e79d..ead247cd 100644
--- a/.github/workflows/bench.yml
+++ b/.github/workflows/bench.yml
@@ -141,7 +141,7 @@ jobs:
       WASMCLOUD_BENCH_REF: ${{ needs.matrix.outputs.ref }}
       BENCH_OUTPUT_DIR: ${{ github.workspace }}/bench-run-output
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.matrix.outputs.checkout_ref }}
           fetch-depth: 0
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 49ae44be..dc8ab99f 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -20,7 +20,7 @@ jobs:
       contents: read
       security-events: write
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
diff --git a/.github/workflows/component-go.yaml b/.github/workflows/component-go.yaml
index 1431addb..d9f47196 100644
--- a/.github/workflows/component-go.yaml
+++ b/.github/workflows/component-go.yaml
@@ -48,7 +48,7 @@ jobs:
     if: ${{ !cancelled() && (needs.changes.result == 'skipped' || needs.changes.outputs.go == 'true') }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
           go-version: ${{ env.GO_VERSION }}
@@ -158,7 +158,7 @@ jobs:
             skip-dev-test: true
             test-command: "true"
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
           go-version: ${{ env.GO_VERSION }}
diff --git a/.github/workflows/component-wit.yaml b/.github/workflows/component-wit.yaml
index 947f7bc2..f8948633 100644
--- a/.github/workflows/component-wit.yaml
+++ b/.github/workflows/component-wit.yaml
@@ -15,7 +15,7 @@ jobs:
       contents: write # for softprops/action-gh-release
       packages: write # for publishing the wit to ghcr.io
     steps:
-    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Extract tag context
       id: ctx
       run: |
diff --git a/.github/workflows/release-tag.yaml b/.github/workflows/release-tag.yaml
index 01145717..2f30e370 100644
--- a/.github/workflows/release-tag.yaml
+++ b/.github/workflows/release-tag.yaml
@@ -60,7 +60,7 @@ jobs:
           app-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
 
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.sha || github.sha }}
           fetch-depth: 0
diff --git a/.github/workflows/release-train.yaml b/.github/workflows/release-train.yaml
index b5aedefa..14c19beb 100644
--- a/.github/workflows/release-train.yaml
+++ b/.github/workflows/release-train.yaml
@@ -56,7 +56,7 @@ jobs:
           private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
 
       # Full history for the tags, which are the source of the current version.
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: main
           fetch-depth: 0
diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml
index af07454a..acabdb89 100644
--- a/.github/workflows/renovate.yaml
+++ b/.github/workflows/renovate.yaml
@@ -19,7 +19,7 @@ jobs:
           app-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
       - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Run Renovate
         uses: renovatebot/github-action@66387ab8c2464d575b933fa44e9e5a86b2822809 # v44.2.4
         with:
diff --git a/.github/workflows/templates-go.yaml b/.github/workflows/templates-go.yaml
index 80a00a54..cdb0c941 100644
--- a/.github/workflows/templates-go.yaml
+++ b/.github/workflows/templates-go.yaml
@@ -47,7 +47,7 @@ jobs:
           - http-hello-world
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # Full history so Go can resolve the SDK from this checkout below.
           fetch-depth: 0