diff --git a/.github/workflows/build-release-task.yml b/.github/workflows/build-release-task.yml
index 5507146..c4993e8 100644
--- a/.github/workflows/build-release-task.yml
+++ b/.github/workflows/build-release-task.yml
@@ -50,7 +50,7 @@ jobs:
       # Default checkout: the triggering commit on its real branch. NBGV classifies from GITHUB_REF
       # directly. fetch-depth: 0 gives NBGV the full history for the version height.
       - name: Checkout code step
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
@@ -108,7 +108,7 @@ jobs:
       # Pin to the versioned commit so the package and the release tag match even if the branch advances
       # mid-run. This is a compile checkout only, NBGV already ran in get-version.
       - name: Checkout code step
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.get-version.outputs.GitCommitId }}
 
@@ -177,7 +177,7 @@ jobs:
 
       # Same versioned commit (GitCommitId) the build used, so the release tag and files match it.
       - name: Checkout code step
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.get-version.outputs.GitCommitId }}
 
diff --git a/.github/workflows/run-codegen-pull-request-task.yml b/.github/workflows/run-codegen-pull-request-task.yml
index d1cc3d9..aeb843c 100644
--- a/.github/workflows/run-codegen-pull-request-task.yml
+++ b/.github/workflows/run-codegen-pull-request-task.yml
@@ -48,7 +48,7 @@ jobs:
           dotnet-version: 10.x
 
       - name: Checkout code step
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ matrix.target.ref }}
           token: ${{ steps.app-token.outputs.token }}
diff --git a/.github/workflows/validate-task.yml b/.github/workflows/validate-task.yml
index 2fafa02..cc8162a 100644
--- a/.github/workflows/validate-task.yml
+++ b/.github/workflows/validate-task.yml
@@ -21,7 +21,7 @@ jobs:
           dotnet-version: 10.x
 
       - name: Checkout code step
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Builds with TreatWarningsAsErrors, so analyzer and code-style warnings fail here.
       # --collect drives coverlet.collector to emit Cobertura XML into ./coverage/<guid>/.
@@ -52,7 +52,7 @@ jobs:
           dotnet-version: 10.x
 
       - name: Checkout code step
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Check C# formatting step
         run: |
@@ -101,7 +101,7 @@ jobs:
           dotnet-version: 10.x
 
       - name: Checkout code step
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Regenerate codegen offline step
         run: |