diff --git a/.github/workflows/local-python-checks.yml b/.github/workflows/local-python-checks.yml
index 2f1dcbc1..44c4d210 100644
--- a/.github/workflows/local-python-checks.yml
+++ b/.github/workflows/local-python-checks.yml
@@ -60,7 +60,7 @@ jobs:
           apt-get install -y --no-install-recommends git ca-certificates
       ## https://github.com/actions/checkout/releases/tag/v6.0.2
       ## > de0fac2e4500dabe0009e67214ff5f5447ce83dd
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
       - name: Install linters
@@ -78,7 +78,7 @@ jobs:
         ## not vendor a copy; checkout @master keeps the org's
         ## single source of truth. Matches the pattern in
         ## local-python-fuzz.yml.
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           repository: org-ai-assisted/developer-meta-files
           ref: master
diff --git a/.github/workflows/local-python-fuzz.yml b/.github/workflows/local-python-fuzz.yml
index 748bad08..6136235f 100644
--- a/.github/workflows/local-python-fuzz.yml
+++ b/.github/workflows/local-python-fuzz.yml
@@ -59,7 +59,7 @@ jobs:
       - name: Checkout repository
         ## https://github.com/actions/checkout/releases/tag/v6.0.2
         ## > de0fac2e4500dabe0009e67214ff5f5447ce83dd
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
 
@@ -88,7 +88,7 @@ jobs:
         ## Needed for ci/step-summary-emit.sh. helper-scripts does
         ## not vendor a copy; checkout @master keeps the org's
         ## single source of truth.
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           repository: org-ai-assisted/developer-meta-files
           ref: master
@@ -126,7 +126,7 @@ jobs:
       - name: Checkout repository
         ## https://github.com/actions/checkout/releases/tag/v6.0.2
         ## > de0fac2e4500dabe0009e67214ff5f5447ce83dd
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           persist-credentials: false
 
@@ -153,7 +153,7 @@ jobs:
         if: always()
         ## Needed for ci/step-summary-emit.sh. See same step in the
         ## 'pr' job above for rationale.
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
           repository: org-ai-assisted/developer-meta-files
           ref: master