diff --git a/.github/workflows/public-repo-guard.yml b/.github/workflows/public-repo-guard.yml
index 719718a..fab8ae5 100644
--- a/.github/workflows/public-repo-guard.yml
+++ b/.github/workflows/public-repo-guard.yml
@@ -42,7 +42,7 @@ jobs:
     name: Secrets + content policy
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd  # v5.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       # gitleaks' GitHub Action requires a paid license for organizations; the CLI
       # itself is MIT-licensed and free. Pin the version AND verify the release
diff --git a/workflow-templates/moq-draft-drift.yml b/workflow-templates/moq-draft-drift.yml
index 2381f6a..a50aa8e 100644
--- a/workflow-templates/moq-draft-drift.yml
+++ b/workflow-templates/moq-draft-drift.yml
@@ -23,7 +23,7 @@ jobs:
     name: Check MoQ Transport draft version drift
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Fetch shared drift-check script if not present
         run: |
diff --git a/workflow-templates/per-commit-gate.yml b/workflow-templates/per-commit-gate.yml
index 3198136..be7b2b8 100644
--- a/workflow-templates/per-commit-gate.yml
+++ b/workflow-templates/per-commit-gate.yml
@@ -35,6 +35,6 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Run checks
         run: echo "replace with your build / test / lint"
diff --git a/workflow-templates/public-repo-guard.yml b/workflow-templates/public-repo-guard.yml
index 719718a..fab8ae5 100644
--- a/workflow-templates/public-repo-guard.yml
+++ b/workflow-templates/public-repo-guard.yml
@@ -42,7 +42,7 @@ jobs:
     name: Secrets + content policy
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd  # v5.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       # gitleaks' GitHub Action requires a paid license for organizations; the CLI
       # itself is MIT-licensed and free. Pin the version AND verify the release
diff --git a/workflow-templates/release-publish.yml b/workflow-templates/release-publish.yml
index 2b78a32..97a72dd 100644
--- a/workflow-templates/release-publish.yml
+++ b/workflow-templates/release-publish.yml
@@ -25,6 +25,6 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Publish
         run: echo "replace with your release / publish step"
diff --git a/workflow-templates/reusable-workflow.yml b/workflow-templates/reusable-workflow.yml
index d40a64d..6b94709 100644
--- a/workflow-templates/reusable-workflow.yml
+++ b/workflow-templates/reusable-workflow.yml
@@ -24,6 +24,6 @@ jobs:
   run:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Reusable step
         run: echo "reusable logic here (no concurrency block belongs in this file)"
diff --git a/workflow-templates/scheduled-job.yml b/workflow-templates/scheduled-job.yml
index 02eca73..7ecf7d3 100644
--- a/workflow-templates/scheduled-job.yml
+++ b/workflow-templates/scheduled-job.yml
@@ -25,6 +25,6 @@ jobs:
   run:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Scheduled task
         run: echo "replace with your scheduled task"