diff --git a/.github/workflows/regenerate-api-diff-otel.yml b/.github/workflows/regenerate-api-diff-otel.yml
index 7e3485c2b..e85367b32 100644
--- a/.github/workflows/regenerate-api-diff-otel.yml
+++ b/.github/workflows/regenerate-api-diff-otel.yml
@@ -14,7 +14,7 @@ jobs:
     permissions:
       contents: read # checkout + read-only `git fetch origin main` for the verify step
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           ref: ${{ github.ref }}
           persist-credentials: false
@@ -61,7 +61,7 @@ jobs:
     permissions:
       contents: write # push regenerated apidiffs back to the renovate branch
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           ref: ${{ github.ref }}
           # zizmor: ignore[artipacked] -- needs credentials to push