diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 427fc857..539d3f96 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -138,7 +138,7 @@ jobs:
         if: github.event_name == 'pull_request'
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                   fetch-depth: 0
 
@@ -195,7 +195,7 @@ jobs:
               if: needs.changes.outputs.docs_only == 'true'
               run: echo 'Frontend quality checks are skipped for docs-only changes.'
 
-            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               if: needs.changes.outputs.docs_only != 'true'
 
             - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
@@ -237,7 +237,7 @@ jobs:
               if: needs.changes.outputs.docs_only == 'true'
               run: echo 'Frontend tests are skipped for docs-only changes.'
 
-            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               if: needs.changes.outputs.docs_only != 'true'
 
             - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
@@ -276,7 +276,7 @@ jobs:
         if: needs.changes.outputs.docs_only != 'true' && needs.changes.outputs.site_changed == 'true'
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
             - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
 
@@ -301,7 +301,7 @@ jobs:
               if: needs.changes.outputs.docs_only == 'true'
               run: echo 'Rust checks are skipped for docs-only changes.'
 
-            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               if: needs.changes.outputs.docs_only != 'true'
 
             - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
@@ -362,7 +362,7 @@ jobs:
             - rust-checks
         runs-on: windows-latest
         steps:
-            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
             - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
 
diff --git a/.github/workflows/community.yml b/.github/workflows/community.yml
index 7adf4396..1019fc0f 100644
--- a/.github/workflows/community.yml
+++ b/.github/workflows/community.yml
@@ -40,7 +40,7 @@ jobs:
         permissions:
             issues: write
         steps:
-            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
             - uses: EndBug/label-sync@52074158190acb45f3077f9099fea818aa43f97a # v2
               with:
                   config-file: .github/labels.yml
diff --git a/.github/workflows/e2e-smoke.yml b/.github/workflows/e2e-smoke.yml
index 5a87a839..40f11eb5 100644
--- a/.github/workflows/e2e-smoke.yml
+++ b/.github/workflows/e2e-smoke.yml
@@ -135,7 +135,7 @@ jobs:
             # WebView2 150+ on GHA Windows needs explicit remote debugging for tauri-driver.
             WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS: --remote-debugging-port=9222 --enable-features=msEdgeDevToolsWdpRemoteDebugging --disable-gpu --no-sandbox --disable-dev-shm-usage
         steps:
-            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
             - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
 
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 2d11b6f0..0c7c8d17 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -26,7 +26,7 @@ jobs:
         name: Build site
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
             - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
 
diff --git a/.github/workflows/pr-template-check.yml b/.github/workflows/pr-template-check.yml
index 09f37080..39d8661d 100644
--- a/.github/workflows/pr-template-check.yml
+++ b/.github/workflows/pr-template-check.yml
@@ -18,7 +18,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Check out base branch workflow files
-              uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                   ref: ${{ github.event.pull_request.base.sha }}
                   persist-credentials: false
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index dffb0401..515e3bb0 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -38,7 +38,7 @@ jobs:
                       exit 1
                   fi
 
-            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                   persist-credentials: false
 
@@ -60,7 +60,7 @@ jobs:
                   )"
                   echo "branch=$release_pr_branch" >> "$GITHUB_OUTPUT"
 
-            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               if: ${{ steps.release.outputs.prs_created == 'true' }}
               with:
                   ref: ${{ steps.release_pr.outputs.branch }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a74baddc..aa9ac1f4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,7 +38,7 @@ jobs:
             should_publish: ${{ steps.release.outputs.should_publish }}
             skip_reason: ${{ steps.release.outputs.skip_reason }}
         steps:
-            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                   fetch-depth: 0
 
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 1d704b58..888994cc 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -110,12 +110,12 @@ jobs:
               if: needs.changes.outputs.docs_only == 'true'
               run: echo "CodeQL is not required for docs-only pull requests (${{ matrix.language }})."
 
-            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               if: needs.changes.outputs.docs_only != 'true'
 
             - name: Initialize CodeQL
               if: needs.changes.outputs.docs_only != 'true'
-              uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4
+              uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4
               with:
                   languages: ${{ matrix.language }}
 
@@ -143,14 +143,14 @@ jobs:
 
             - name: Analyze
               if: needs.changes.outputs.docs_only != 'true'
-              uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4
+              uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4
 
     audits:
         name: Dependency audits
         if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
             - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
               with:
diff --git a/.github/workflows/velopack-build.yml b/.github/workflows/velopack-build.yml
index d3ae5aa0..51688b82 100644
--- a/.github/workflows/velopack-build.yml
+++ b/.github/workflows/velopack-build.yml
@@ -40,7 +40,7 @@ jobs:
             cloudflare_r2_bucket_name: ${{ steps.product.outputs.cloudflare_r2_bucket_name }}
             artifact_release_notes_name: ${{ steps.artifacts.outputs.release_notes_name }}
         steps:
-            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                   ref: ${{ inputs.target-commitish }}
                   fetch-depth: 0
@@ -165,7 +165,7 @@ jobs:
         needs: prepare-release
         runs-on: windows-latest
         steps:
-            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                   ref: ${{ inputs.target-commitish }}
                   fetch-depth: 0
@@ -314,7 +314,7 @@ jobs:
         needs: prepare-release
         runs-on: macos-latest
         steps:
-            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                   ref: ${{ inputs.target-commitish }}
                   fetch-depth: 0
@@ -408,7 +408,7 @@ jobs:
         needs: prepare-release
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                   ref: ${{ inputs.target-commitish }}
                   fetch-depth: 0
@@ -526,7 +526,7 @@ jobs:
             - build-linux
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                   ref: ${{ inputs.target-commitish }}
                   fetch-depth: 0
@@ -627,7 +627,7 @@ jobs:
         runs-on: ubuntu-latest
         environment: ${{ inputs.deployment-environment }}
         steps:
-            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                   ref: ${{ inputs.target-commitish }}
                   fetch-depth: 0