diff --git a/.github/workflows/extension-ai-analysis.yml b/.github/workflows/extension-ai-analysis.yml
index 9b054bed..3b1d190b 100644
--- a/.github/workflows/extension-ai-analysis.yml
+++ b/.github/workflows/extension-ai-analysis.yml
@@ -31,7 +31,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout base repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         # No repository/ref override — checks out the BASE repo with trusted scripts.
 
       - name: Setup Python
diff --git a/.github/workflows/extension-validation.yml b/.github/workflows/extension-validation.yml
index 7c45f0f0..76e9d7b9 100644
--- a/.github/workflows/extension-validation.yml
+++ b/.github/workflows/extension-validation.yml
@@ -19,7 +19,7 @@ jobs:
       pull-requests: write
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0 # Fetch full history for git diff
 
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 84c6907e..bfeff1d1 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.12"
diff --git a/.github/workflows/package-python-extension.yml b/.github/workflows/package-python-extension.yml
index 9d348457..4aadb2be 100644
--- a/.github/workflows/package-python-extension.yml
+++ b/.github/workflows/package-python-extension.yml
@@ -16,7 +16,7 @@ jobs:
     outputs:
       extensions: ${{ steps.get-extensions.outputs.extensions }}
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
 
@@ -96,7 +96,7 @@ jobs:
 
       - name: Checkout Slicer source
         if: steps.check-cpp.outputs.skip != 'true'
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: lassoan/Slicer
           ref: python-ext-build