diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index bafadcd..3b12681 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -66,7 +66,7 @@ jobs:
           echo "actual_sha=${ACTUAL_SHA}" >> $GITHUB_OUTPUT
 
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: ${{ steps.branch.outputs.actual_sha }}
 
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index a6a5d7f..19b7ccb 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -61,7 +61,7 @@ jobs:
       # radius is an ephemeral runner rather than this repository, but a pin
       # costs nothing and `.github/dependabot.yml` maintains it.
       - name: Checkout repository
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # FULL HISTORY IS REQUIRED, not a default worth trimming.
           # `scripts/licensing.test.ts` holds `path-to-document` to the commit