diff --git a/.github/workflows/header-check.yml b/.github/workflows/header-check.yml
index 52ba9030..2d5a58e2 100644
--- a/.github/workflows/header-check.yml
+++ b/.github/workflows/header-check.yml
@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Checkout Repository'
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Check License Header
         uses: apache/skywalking-eyes/header@ab3d1fe50d23f9c82eff489297167e2dde8ba6cb # main
diff --git a/.github/workflows/json-lint.yml b/.github/workflows/json-lint.yml
index 50e79d6e..565c3364 100644
--- a/.github/workflows/json-lint.yml
+++ b/.github/workflows/json-lint.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Run JSON Lint
         run: jq . gemini-extension.json
\ No newline at end of file
diff --git a/.github/workflows/markdown-checks.yml b/.github/workflows/markdown-checks.yml
index d767d45c..7388cb63 100644
--- a/.github/workflows/markdown-checks.yml
+++ b/.github/workflows/markdown-checks.yml
@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Link Checker
         uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2.8.0
diff --git a/.github/workflows/mcp-check.yml b/.github/workflows/mcp-check.yml
index a5fe5ab5..28033105 100644
--- a/.github/workflows/mcp-check.yml
+++ b/.github/workflows/mcp-check.yml
@@ -25,10 +25,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: '20'
 
diff --git a/.github/workflows/presubmit-tests.yml b/.github/workflows/presubmit-tests.yml
index 515707f0..63e1148c 100644
--- a/.github/workflows/presubmit-tests.yml
+++ b/.github/workflows/presubmit-tests.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Install Gemini CLI
         run: npm install @google/gemini-cli
diff --git a/.github/workflows/skills-validate.yml b/.github/workflows/skills-validate.yml
index 440b69d5..8febaeb7 100644
--- a/.github/workflows/skills-validate.yml
+++ b/.github/workflows/skills-validate.yml
@@ -30,10 +30,10 @@ jobs:
   skills-validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.11"
 
diff --git a/.github/workflows/sync-labels.yaml b/.github/workflows/sync-labels.yaml
index 9edf6ced..0c781666 100644
--- a/.github/workflows/sync-labels.yaml
+++ b/.github/workflows/sync-labels.yaml
@@ -29,7 +29,7 @@ jobs:
       issues: 'write'
       pull-requests: 'write'
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: micnncim/action-label-syncer@3abd5ab72fda571e69fffd97bd4e0033dd5f495c # v1.3.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}