diff --git a/.github/workflows/validate-hooks.yml b/.github/workflows/validate-hooks.yml
index 52da430..11dbb44 100644
--- a/.github/workflows/validate-hooks.yml
+++ b/.github/workflows/validate-hooks.yml
@@ -18,7 +18,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: |
           for t in dot_claude/hooks/tests/*.test.sh; do
             echo "== $t"
diff --git a/.github/workflows/validate-skills.yml b/.github/workflows/validate-skills.yml
index 9907f88..b67fb8d 100644
--- a/.github/workflows/validate-skills.yml
+++ b/.github/workflows/validate-skills.yml
@@ -18,7 +18,7 @@ jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       # Static mode only: no ~/.agents tree on the runner (deployed pass skips
       # silently) and no GPG, so encrypted skills are not validated here.
       - run: ruby dot_agents/skills/scripts/validate-skills.rb
diff --git a/.github/workflows/validate-zsh-plugins.yml b/.github/workflows/validate-zsh-plugins.yml
index 72e44e7..d9254dc 100644
--- a/.github/workflows/validate-zsh-plugins.yml
+++ b/.github/workflows/validate-zsh-plugins.yml
@@ -21,7 +21,7 @@ jobs:
       # renovate: datasource=github-releases depName=twpayne/chezmoi
       CHEZMOI_VERSION: v2.71.0
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install smoke-test dependencies
         run: |
           sudo apt-get update