diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 76d0cc53..fbdd1883 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.0
 
       - name: Copy CI gradle.properties
         run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index e593e52c..a2fdb431 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -39,7 +39,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.0
 
       # JDK 25 matches the version used by every other workflow in
       # this repo. Runs on the RUNNER, not inside the Docker
diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml
index 2d2b5a1d..1faf26f8 100644
--- a/.github/workflows/documentation.yml
+++ b/.github/workflows/documentation.yml
@@ -27,7 +27,7 @@ jobs:
     
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.0
         
       - name: Set up JDK 25
         uses: actions/setup-java@v5
diff --git a/.github/workflows/engine-benchmarks.yml b/.github/workflows/engine-benchmarks.yml
index fc4fb225..b205a0e7 100644
--- a/.github/workflows/engine-benchmarks.yml
+++ b/.github/workflows/engine-benchmarks.yml
@@ -43,7 +43,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.0
 
       - name: Set up JDK 21
         uses: actions/setup-java@v5
@@ -93,7 +93,7 @@ jobs:
     runs-on: [self-hosted, linux, x86_64, skainet-bench-linux-x86]
     timeout-minutes: 120
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.0
 
       - name: Show runner identity
         run: |
diff --git a/.github/workflows/java-tests.yml b/.github/workflows/java-tests.yml
index 158e45e2..21ebf9f5 100644
--- a/.github/workflows/java-tests.yml
+++ b/.github/workflows/java-tests.yml
@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.0
 
       - name: Copy CI gradle.properties
         run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties
diff --git a/.github/workflows/native-cpu-multiarch.yml b/.github/workflows/native-cpu-multiarch.yml
index 5ce542e1..d0e6b8a9 100644
--- a/.github/workflows/native-cpu-multiarch.yml
+++ b/.github/workflows/native-cpu-multiarch.yml
@@ -55,7 +55,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.0
 
       - name: Copy CI gradle.properties (Unix)
         if: runner.os != 'Windows'
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index b5c8bdf5..40358f1b 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -51,7 +51,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.0
 
       - name: Set up JDK 25
         uses: actions/setup-java@v5
@@ -93,7 +93,7 @@ jobs:
     runs-on: macOS-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.0
 
       - name: Set up JDK 25
         uses: actions/setup-java@v5
diff --git a/.github/workflows/reuse-compliance.yml b/.github/workflows/reuse-compliance.yml
index aa03e0e9..eec17ae8 100644
--- a/.github/workflows/reuse-compliance.yml
+++ b/.github/workflows/reuse-compliance.yml
@@ -31,7 +31,7 @@ jobs:
     
     steps:
       - name: "Checkout Repository"
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       
       - name: "Run REUSE Compliance Check"
         uses: fsfe/reuse-action@676e2d560c9a403aa252096d99fcab3e1132b0f5 # v6.0.0
\ No newline at end of file
diff --git a/.github/workflows/schema-validation.yml b/.github/workflows/schema-validation.yml
index b58e58b4..03c4c535 100644
--- a/.github/workflows/schema-validation.yml
+++ b/.github/workflows/schema-validation.yml
@@ -15,7 +15,7 @@ jobs:
     
     steps:
     - name: Checkout code
-      uses: actions/checkout@v7
+      uses: actions/checkout@v7.0.0
       
     - name: Set up JDK 25
       uses: actions/setup-java@v5
diff --git a/.github/workflows/verify-poms.yml b/.github/workflows/verify-poms.yml
index 5ad69df4..0d6f5b3f 100644
--- a/.github/workflows/verify-poms.yml
+++ b/.github/workflows/verify-poms.yml
@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.0
 
       - name: Copy CI gradle.properties
         run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties