diff --git a/.github/workflows/base-images-upgrade.yaml b/.github/workflows/base-images-upgrade.yaml
index b081a737..3e88980d 100644
--- a/.github/workflows/base-images-upgrade.yaml
+++ b/.github/workflows/base-images-upgrade.yaml
@@ -28,7 +28,7 @@ jobs:
           echo "This workflow should not be run on a non-branch-head."
           exit 1
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - id: go-version
         run: |
diff --git a/.github/workflows/e2e-test.yaml b/.github/workflows/e2e-test.yaml
index c1343575..7ab67416 100644
--- a/.github/workflows/e2e-test.yaml
+++ b/.github/workflows/e2e-test.yaml
@@ -17,7 +17,7 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - id: go-version
         run: |
diff --git a/.github/workflows/govulncheck.yaml b/.github/workflows/govulncheck.yaml
index 8171eeb4..5ffaec38 100644
--- a/.github/workflows/govulncheck.yaml
+++ b/.github/workflows/govulncheck.yaml
@@ -20,7 +20,7 @@ jobs:
     if: github.repository == 'cert-manager/makefile-modules'
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         # Adding `fetch-depth: 0` makes sure tags are also fetched. We need
         # the tags so `git describe` returns a valid version.
         # see https://github.com/actions/checkout/issues/701 for extra info about this option
diff --git a/.github/workflows/kind-images-upgrade.yaml b/.github/workflows/kind-images-upgrade.yaml
index 3abc8f0e..4b861680 100644
--- a/.github/workflows/kind-images-upgrade.yaml
+++ b/.github/workflows/kind-images-upgrade.yaml
@@ -28,7 +28,7 @@ jobs:
           echo "This workflow should not be run on a non-branch-head."
           exit 1
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - id: go-version
         run: |
diff --git a/.github/workflows/validate-renovate-config.yaml b/.github/workflows/validate-renovate-config.yaml
index 65e356d4..35751a5d 100644
--- a/.github/workflows/validate-renovate-config.yaml
+++ b/.github/workflows/validate-renovate-config.yaml
@@ -17,6 +17,6 @@ jobs:
       image: renovate/renovate:43.258.0@sha256:eebc7b62df7917148cfe075e351b10a8d76d80932930a6a03d2cfc4a2229fae6
       options: --user root
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: renovate --version
       - run: renovate-config-validator .github/renovate.json5
diff --git a/modules/go/base/.github/workflows/govulncheck.yaml b/modules/go/base/.github/workflows/govulncheck.yaml
index 9c6c2cfb..a8d05850 100644
--- a/modules/go/base/.github/workflows/govulncheck.yaml
+++ b/modules/go/base/.github/workflows/govulncheck.yaml
@@ -20,7 +20,7 @@ jobs:
     if: github.repository == '{{REPLACE:GH-REPOSITORY}}'
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         # Adding `fetch-depth: 0` makes sure tags are also fetched. We need
         # the tags so `git describe` returns a valid version.
         # see https://github.com/actions/checkout/issues/701 for extra info about this option