diff --git a/.github/workflows/ci-data-sanitization-log-providers.yml b/.github/workflows/ci-data-sanitization-log-providers.yml
index b00eae9..c072727 100644
--- a/.github/workflows/ci-data-sanitization-log-providers.yml
+++ b/.github/workflows/ci-data-sanitization-log-providers.yml
@@ -41,7 +41,7 @@ jobs:
       matrix:
         node-version: [20, 22, 24]
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - run: corepack enable
@@ -61,7 +61,7 @@ jobs:
       - run: yarn workspace data-sanitization-log-providers test:coverage
       - name: Report coverage
         if: matrix.node-version == 24
-        uses: davelosert/vitest-coverage-report-action@02f3c2e641286b7fa308cd3e430783103ce6103b # v2
+        uses: davelosert/vitest-coverage-report-action@3c054a2d2e2ca45446417ad5d6d5eb33092af8f1 # v2
         with:
           json-summary-path: coverage/coverage-summary.json
           json-final-path: coverage/coverage-final.json
diff --git a/.github/workflows/ci-data-sanitization.yml b/.github/workflows/ci-data-sanitization.yml
index 8b10d40..7a05b71 100644
--- a/.github/workflows/ci-data-sanitization.yml
+++ b/.github/workflows/ci-data-sanitization.yml
@@ -39,7 +39,7 @@ jobs:
       matrix:
         node-version: [20, 22, 24]
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - run: corepack enable
@@ -58,7 +58,7 @@ jobs:
       - run: yarn workspace data-sanitization test:coverage
       - name: Report coverage
         if: matrix.node-version == 24
-        uses: davelosert/vitest-coverage-report-action@02f3c2e641286b7fa308cd3e430783103ce6103b # v2
+        uses: davelosert/vitest-coverage-report-action@3c054a2d2e2ca45446417ad5d6d5eb33092af8f1 # v2
         with:
           json-summary-path: coverage/coverage-summary.json
           json-final-path: coverage/coverage-final.json
diff --git a/.github/workflows/ci-root.yml b/.github/workflows/ci-root.yml
index b95663c..af590fb 100644
--- a/.github/workflows/ci-root.yml
+++ b/.github/workflows/ci-root.yml
@@ -38,7 +38,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - run: corepack enable
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 4e11618..1e81332 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -38,7 +38,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false