diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 294af25..aca1f9c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -56,7 +56,7 @@ jobs:
     env:
       EARTHLY_CONVERSION_PARALLELISM: "5"
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       # The dind (common+alpine-kind-test and common+ubuntu-kind-test) detects
       # the host's IPv6 capability and then requires IPv6 NAT to create networks
       # for kind. So we load it here.
diff --git a/.github/workflows/earthly-count.yml b/.github/workflows/earthly-count.yml
index eaaf0fa..dfe9740 100644
--- a/.github/workflows/earthly-count.yml
+++ b/.github/workflows/earthly-count.yml
@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: Checkout PR branch
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0