diff --git a/.github/workflows/codex-raw-ci.yml b/.github/workflows/codex-raw-ci.yml
index 12e6e9e58..606e1ef96 100644
--- a/.github/workflows/codex-raw-ci.yml
+++ b/.github/workflows/codex-raw-ci.yml
@@ -31,7 +31,7 @@ jobs:
 
     steps:
       - name: Check out source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/codex-raw-release.yml b/.github/workflows/codex-raw-release.yml
index 0241983a1..fde19697e 100644
--- a/.github/workflows/codex-raw-release.yml
+++ b/.github/workflows/codex-raw-release.yml
@@ -28,7 +28,7 @@ jobs:
 
     steps:
       - name: Check out tagged source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -184,7 +184,7 @@ jobs:
 
     steps:
       - name: Check out tagged source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -359,7 +359,7 @@ jobs:
           }
 
       - name: Check out validated release notes
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.validate.outputs.commit }}
           persist-credentials: false